Technical impact
A logic error in the delete handler of the MISP CRUD component causes validation failures to be bypassed for HTTP DELETE requests. Because the missing parentheses make the delete condition evaluate as (validationError is null AND request method is POST) OR request method is DELETE, an authenticated attacker can send a DELETE request and successfully delete a record even when the application‑level validation callback would otherwise deny the operation. This flaw allows the destruction of data that should have been protected by validation or authorization checks, compromising data integrity and availability.
Affected Systems
The vulnerability affects the MISP platform from the vendor misp. Affected product: MISP MISP. No specific version information is provided in the CVE data; administrators should verify if their deployed MISP instance contains the code referenced in the GitHub commit audit.
Risk and Exploitability
The CVSS score of 7.9 indicates high severity, but the EPSS score is not available, suggesting that the exploit probability is not quantified. The flaw is not listed in the CISA KEV catalog. The attack requires an authenticated user with access to a delete endpoint; the attacker can send an HTTP DELETE request to trigger the bypass. No additional prerequisites beyond authentication are described in the CVE data, implying that once the user can authenticate to the MISP service, the deletion can be performed.
