MISP contains an improper authorization flaw that allows an authenticated organization administrator to view or change the settings of site administrator accounts within the same organization. The vulnerability arises from access‑control logic that scoped administrative actions by organization membership without excluding higher‑privileged site administrators. As a result, an organization administrator can cross the intended privilege boundary and alter administrative user settings and login profile information, effectively elevating their influence over site‑wide administration. The weakness maps to CWE-639 and CWE-863, highlighting insufficient authorization checks.

The affected product is MISP, as identified by the CNA "mispro:mis". All installations that include the legacy ACL logic—prior to the patch that hardens the ACLs—are vulnerable. No specific version ranges are listed in the CVE, so any MISP deployment using the default configuration before the recent ACL fix is potentially impacted.

The CVSS score of 5.1 indicates a medium severity, and the EPSS score is not available, while it is not listed in the CISA KEV catalog. Because the flaw requires an authenticated organization administrator, an attacker needs legitimate credentials, but once they have them, they can exploit the missing authorization bypass. The likely attack vector is via the web interface or API authenticated as an organization administrator. The vulnerability’s impact is limited to configuration changes of site administrators; however, this can destabilize site governance and compromise overall security posture.