MISP’s processModuleResultsData method contains an insecure direct object reference that allows an authenticated user with permission to submit module results to include a client‑supplied report id that references an existing report belonging to another event. Because the code does not unset the id field before calling save(), the underlying ORM updates the referenced row instead of inserting a new one. This enables the attacker to read, overwrite, and re‑parent another user’s report, effectively bypassing access controls and compromising confidentiality and integrity of event data.

The vulnerability affects the MISP event reporting component in all releases earlier than version 2.5.47. Users running MISP in these versions are susceptible to the described IDOR and cross‑event data manipulation.

The CVSS score of 8.3 indicates a high severity of the flaw. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated session with the right to submit module results, typically accessed through the web interface or API. If the attacker can obtain a valid session or compromise credentials, they can craft module result payloads that trick the system into re‑parenting or overwriting reports from other events. The risk is therefore significant for environments where many users have module result submission rights.