Executive brief
MISP is an open-source threat intelligence platform used by organizations to share and analyze cyber threat data. A security flaw was identified where users with only "read-only" or "view" permissions could bypass restrictions to modify or inject data into existing security events. This could allow an unauthorized user to compromise the integrity of threat intelligence data, potentially leading to misinformation or the corruption of critical security records.
Technical details
An authorization bypass exists in MISP's EventsController::importModule() due to missing permission checks in the write path for modules returning results in the 'misp_standard' format. While the controller correctly identifies the user's identity, it fails to invoke the __canModifyEvent() check before persisting module output to the database. This allows an authenticated attacker with 'view' access or a read-only API key to inject or alter event attributes. The vulnerability is exploited by sending a request to the importModule endpoint for an event the user can see but not modify. The issue has been addressed in the MISP core by enforcing modification-rights checks identical to those used in the handleModuleResults() path.
Affected products
- MISP MISP <= 2.5.42
Timeline
- 2026-07-08: advisory: NVD publication date
- 2026-07-08: patched: Fix committed to MISP repository