Broken access control in the bulk deletion endpoints of MISP Core allows authenticated users with broad role permissions to delete event reports and sharing groups across the entire instance regardless of ownership. The flaw stems from relying on global capability checks instead of per‑object authorization, enabling a contributor‑level or sharing‑group‑capable user to hard‑delete reports or groups belonging to other organisations. This results in loss of event‑report data and the removal of sharing‑group configurations, compromising data integrity and availability.

Vendors: MISP. Product: MISP Core. No specific version information is provided, but the flaw applies to any instance using the affected bulk deletion flows before the patch referenced in the commit history.

With a CVSS score of 9.4 the vulnerability is classified as critical. An authenticated attacker who possesses the broad role permissions required by the broken checks can trigger the bulk deletion endpoints and erase managed objects belonging to other organisations. The EPSS score is not available, and the vulnerability is not yet listed in CISA KEV. The attack vector is inferred to be an authenticated user exploitation of the bulk delete functionality to delete objects beyond their authority, leading to data loss and potential disruption of organisational collaboration.