A mass assignment flaw in the MISP user edit function allows an authenticated attacker to supply a different User.id value than the session’s own, causing the system to apply updates to an unintended account. This is a CWE‑269 improper authorization vulnerability. The attacker can modify any fields that the edited user role permits, thereby compromising the integrity of another account. This enables unauthorized control over user attributes without having elevated privileges beyond those harvested through the normal authentication channel.

The vulnerability is present in the MISP platform provided by the MISP vendor. No specific product version is listed in the CNA data, so any build that has not applied the referenced patch could be impacted.

The CVSS score of 9 signals a critical level of risk, and while an EPSS score is not provided, the lack of exploitation statistics does not mitigate the severity. The vulnerability requires that the attacker be authenticated and possess sufficient rights to perform a user edit. If the attacker can craft a custom request—likely through the web interface or API—the flaw can be exploited remotely. The issue is not catalogued in CISA KEV, but the high CVSS rating warrants immediate attention.