MISP is affected by several mass assignment weaknesses that allow an authenticated user to submit fields that should be controlled by the server, such as identifiers and ownership attributes. By crafting a request that includes these protected fields, the attacker can alter the owner of an event, redirect updates to other records, overwrite event delegation requests, or modify shadow attribute proposals belonging to different organizations. The primary consequence is the unauthorized modification of MISP objects, and depending on visibility and sharing settings, the attacker may gain access to or transfer sensitive threat intelligence data. The vulnerability is a classic example of CWE‑639, where information leakage through improper input validation is exploited for privilege escalation.

The platform MISP (Vendor: misp, Product: MISP) and all installations that include the following controllers are impacted: CollectionsController::edit(), EventDelegationsController::delegateEvent(), ShadowAttributesController::edit(), TagCollectionsController::edit(), and TagCollectionsController::editWithTags(). No specific version details are listed, so any current deployment that contains these components is potentially vulnerable.

The CVSS score of 8.8 indicates a high severity. The EPSS score is not available, but the CVE notes that exploitation requires authentication and network access to the affected endpoints, with no user interaction needed. The vulnerability is not listed in the CISA KEV catalog, suggesting that it is not currently exploited in the wild. An attacker who can authenticate to MISP and reach these endpoints can construct HTTP requests that override ownership fields, thereby elevating privileges or causing unauthorized data disclosure or modification.