Executive brief
MISP, a popular open-source threat intelligence platform, contained a security flaw that allowed users to modify data they did not own. By sending specially crafted requests, an authenticated user could change the ownership of threat data, redirect updates to different records, or access sensitive intelligence belonging to other organizations. This could lead to unauthorized data modification and the exposure of confidential threat information.
Technical details
MISP is vulnerable to multiple mass assignment flaws (CWE-639) within several controllers, including Collections, EventDelegations, ShadowAttributes, and TagCollections. The application failed to properly restrict user-supplied fields in HTTP requests, allowing internal fields like 'id', 'org_id', and 'user_id' to be overwritten. An authenticated attacker can exploit this to redirect updates to different records, modify shadow attribute proposals of other organizations, or hijack object ownership. The vulnerability was addressed by pinning identity fields to their stored values during edit operations and stripping primary keys from create-only save paths.
Affected products
- MISP Project MISP Prior to commit 9341690e9b6dde7f0605edea5533e05ba7362e35
Timeline
- 2026-06-12: disclosed
- 2026-06-12: advisory