Executive brief
MISP is an open-source threat intelligence platform used by organizations to share and collaborate on malware analysis and security indicators. An authenticated user with permission to submit module results could manipulate event reports to read, modify, or reassign reports belonging to other events, potentially exposing sensitive threat intelligence and compromising data integrity.
Technical details
The processModuleResultsData method in the Event model fails to unset the client-supplied 'id' field from EventReport entries before saving, unlike adjacent attribute and object processing loops. An authenticated attacker can reference an existing report's ID to trigger an ORM update instead of insert, allowing cross-event data disclosure and integrity compromise. The vulnerability requires authentication and module result submission permission.
Affected products
- MISP Project MISP before 2.5.47
Timeline
- 2026-09-21: disclosed
- 2026-09-21: patched: Fix committed in version 2.5.47+