Executive brief
MISP is a threat intelligence platform that analysts use to share and collaborate on security events. A flaw in the EventReports functionality allows any authenticated user to modify report content, regardless of their assigned permissions. This could allow users to alter or corrupt shared intelligence data that other analysts and automated systems rely upon for threat detection.
Technical details
The replaceSuggestionInReport action in the EventReports component was incorrectly mapped to the wildcard permission ('*') in ACLComponent, granting access to all authenticated users instead of requiring the perm_add permission like analogous modification actions. An authenticated attacker can invoke the replaceSuggestionInReport endpoint to alter suggestion content within event reports, bypassing the intended authorization model.
Affected products
- MISP Project MISP
Timeline
- 2026-09-22: disclosed
- 2026-09-22: patched: Fixed in commit 66aebfb1a by changing replaceSuggestionInReport permission mapping from '*' to 'perm_add'