An authorization flaw in MISP allows an organization administrator to target and reset passwords for site administrator accounts that belong to the same organization. The flaw is caused by an authorization mistake that permits organization admins to query site administrators through the email‑reset feature, bypassing the intended restriction that limits queries to users within the same organization. Successful exploitation results in compromise of the target account and elevation of the attacker’s privileges, potentially giving full control over the MISP instance. The weakness is listed as CWE‑863 – Authorization Control for Privileges.

The vulnerability impacts the MISP platform (vendor misp). Affected versions are not specified in the advisory, so all released MISP code that includes the legacy organization‑administrator email functionality is potentially vulnerable until patched.

The base score is 7.5, indicating high severity. The exploit probability is not publicly available, and the vulnerability is not listed in the CISA KEV catalog. The attack requires the attacker to be authenticated as an organization administrator within the same organization that hosts the targeted site administrator. No external exploitation beyond the authenticated user's rights is needed, making this a direct privilege‑escalation scenario rather than a remote code execution. The risk remains high because gaining site‑admin control compromises confidentiality, integrity, and availability of the entire MISP deployment.