The vulnerability allows an authenticated user to supply request fields that include primary keys and ownership identifiers, which the MISP core fails to validate or re-pin before persisting data. In the affected controllers, the raw values supplied by the client can be applied to existing database records, resulting in creation of new objects, overwriting existing ones, re-parenting events, transferring ownership, or inserting attacker‑controlled content into another user’s context. These impacts threaten confidentiality, integrity, and availability of data across the platform and can be used for malicious data injection or unauthorized sharing.

The affected product is MISP Core, specifically various controllers and models that process REST or form submissions. All instances using MISP versions before the patch commits identified in the reference list are vulnerable; no explicit version range is listed, but any deployment prior to the latest changes must be considered at risk.

The CVSS score of 9.4 indicates critical severity. EPSS is not available, so no exploitation likelihood can be quantified. The vulnerability is not listed in CISA KEV, but the lack of automatic ID validation means an attacker with valid credentials could exploit it easily. The likely attack vector is an authenticated HTTP request to a vulnerable endpoint where the attacker crafts payloads containing unintended primary and ownership keys; the system then persists the data against the targeted object, bypassing its authorization checks.