A critical access control vulnerability in MISP allows authenticated users with broad role permissions to delete critical data belonging to other organizations.

The application relies on global permissions rather than per-object authorization checks in bulk deletion handlers, allowing authenticated contributors to delete Event Reports and Sharing Groups belonging to other organizations.

Successful exploitation allows for the catastrophic loss of intelligence data and configuration across a MISP instance. By bypassing ownership gates, an attacker can disrupt threat intelligence sharing activities, leading to data loss and the compromise of collaborative security efforts. The CVSS score of 9.4 reflects the high impact on data availability and integrity.

Immediate Action: Update MISP to the latest version, which implements mandatory per-object authorization checks (e.g., fetchIfAuthorized and checkIfOwner) for bulk deletions.

Proactive Monitoring: Review audit logs for bulk deletion events and compare the user performing the action against the ownership of the deleted objects.

Compensating Controls: Implement strict role-based access control (RBAC) policies and limit the number of users granted broad "add" or "sharing group" permissions until the patch is applied.

Public Exploit Available: No

This vulnerability undermines the trust model of the MISP platform. Organizations must prioritize the update to ensure that granular access controls are enforced, preventing unauthorized users from impacting the integrity of shared threat intelligence.