A client‑controlled ShadowAttribute proposal creation endpoint in MISP was found to honor a supplied primary key field without removing it before persisting the record. As the underlying framework interprets an explicit id as a command to update an existing database row, an authenticated user who can submit shadow attribute proposals could supply the identifier of an existing ShadowAttribute and trigger an unintentional update of that record instead of creating a new proposal. This flaw facilitates unauthorized modification of shadow attributes, enabling the attacker to alter data tied to events they should not have permission to modify and, depending on API response exposure, potentially shift or leak proposal data across event boundaries.

MISP (Malware Information Sharing Platform) versions older than 2.5.38 are vulnerable. The fix that removes the id field during payload processing was released in MISP 2.5.38, so any deployment running an earlier release is at risk.

The CVSS score of 8.3 indicates high severity, and the lack of an EPSS score suggests limited publicly known exploitation data at present. The vulnerability is not listed in CISA KEV. Because exploitation requires an authenticated session with permissions to create shadow attribute proposals, attackers need appropriate access credentials. Once authenticated, they can trigger the flaw by sending a crafted request containing an existing ShadowAttribute id, causing the system to overwrite selected fields. The high severity combined with the ability to modify protected data makes this a critical concern for organizations that rely on strict access controls for MISP events.