An access control flaw in MISP EventReports allows any authenticated user to invoke the replaceSuggestionInReport endpoint and modify suggestion content within event reports. The action was mistakenly mapped to the wildcard permission, so users lacking the explicit perm_add permission could alter reports. This breach of authorization permits the injection of misleading or corrupted threat intelligence into shared reports.

MISP MISP product is affected. All versions that implement EventReports functionality prior to the fix are vulnerable. The patch implements ACL mapping changes; install the updated version or apply the committed change (commit 66aebfb1a). No specific version range is provided, so all current installations that have not applied the commit are potentially impacted.

The CVSS score is 5.3, indicating moderate severity. EPSS is not available, and KEV does not list the vulnerability. The vulnerability is exploitable by any authenticated user, as the endpoint is accessible without additional permissions. Because the flaw is on the server side, the attack does not require special network privileges. The risk is primarily to the integrity and confidentiality of shared threat intelligence, as unauthorized users can corrupt or mislead reports used by analysts and automated consumers.