Executive brief
MISP, an open-source threat intelligence platform, contained several security flaws that allowed users to modify or delete data belonging to other organizations. An authenticated user with basic permissions could exploit these errors to remove tags from reports, delete collection elements, or overwrite analyst data they did not own. This could lead to the corruption of shared intelligence and disruption of security operations across different teams using the same platform.
Technical details
Multiple broken access-control (IDOR) vulnerabilities were identified in MISP core affecting several subsystems. The flaws include: (1) Event Reports tag removal where the application authorized one report but mutated another based on request body IDs; (2) Collection Elements bulk deletion where authorization was checked against a collection ID matching the element's row ID rather than its parent; (3) Analyst Data updates bypassing ownership checks during nested captures; (4) Template Elements editing authorizing against the element ID instead of the parent template; and (5) Decaying Model write paths using view-scope access instead of edit-ownership verification. An authenticated attacker with subsystem-specific permissions can perform unauthorized cross-organization modifications or deletions. Patches have been released in the MISP main branch across several commits.
Affected products
- MISP Project MISP <= 2.5.41
Timeline
- 2026-06-22: disclosed
- 2026-06-22: advisory
References
- https://github.com/MISP/MISP/commit/24d7e91339a3ef043652dd5799c36e5065b2bb4a
- https://github.com/MISP/MISP/commit/3aecc04d5816189412b589cf590c6dbe9a8db5c0
- https://github.com/MISP/MISP/commit/57ad774d21bd1863d060a9e6e73ae54eb96784ce
- https://github.com/MISP/MISP/commit/744005cefdc3b943bd29669c3b34cc66a5fc2154
- https://github.com/MISP/MISP/commit/ba2f51fe7440ba2c6043ccde858cac1e25f96931