Executive brief
A vulnerability in the MISP threat intelligence platform allows users to modify existing data records they should not have access to. By submitting a specially crafted proposal for a new attribute that includes an existing record's ID, an attacker can overwrite that record instead of creating a new one. This could lead to unauthorized data modification or the exposure of sensitive information across different event contexts.
Technical details
An authorization bypass (CWE-639) exists in the ShadowAttribute proposal creation workflow of MISP. The 'add' action in the ShadowAttributesController fails to strip the 'id' field from user-supplied request data before saving. Because the underlying framework interprets a provided primary key as an update instruction rather than a creation request, an authenticated attacker can overwrite existing ShadowAttribute records. This allows for unauthorized modification of attributes associated with events outside the user's scope and may lead to data leakage across event contexts. The issue is resolved in MISP 2.5.38 by explicitly unsetting the 'id' field from the request data.
Affected products
- MISP Project MISP < 2.5.38
Timeline
- 2026-05-20: disclosed
- 2026-05-20: advisory
- 2026-05-20: patched: Fixed in version 2.5.38