A high-severity authorization bypass in MISP allows authenticated users to perform unauthorized deletions of threat intelligence data, risking the integrity of security operations.

The vulnerability is an incorrect authorization flaw (CWE-863) within the MispAttribute::deleteAttribute function. Authenticated users belonging to an organization can bypass event modification rules to delete attributes even if their assigned role lacks the necessary permissions to modify that specific event.

The ability for unauthorized users to delete attributes from threat intelligence events poses a significant risk to organizational security posture. Because MISP is often the central repository for critical indicators of compromise, successful exploitation could lead to the loss of vital threat data, hindering incident response efforts and potentially allowing malicious activity to go undetected. With a CVSS score of 8.3, this flaw is categorized as high severity due to the high impact on data integrity and the relative ease of exploitation for existing platform users.

Immediate Action: Administrators must update MISP to a version beyond 2.5.45 that incorporates the corrected authorization logic provided in the vendor patch.

Proactive Monitoring: Security teams should review MISP audit logs for anomalous bulk attribute deletions or deletions performed by accounts that typically do not possess event modification privileges.

Compensating Controls: While no direct WAF rule can fix an internal logic flaw, organizations should enforce strict role-based access control (RBAC) and limit the number of users with elevated privileges until the patch is applied.

Public Exploit Available: No (exploit_available: false)

This vulnerability represents a significant risk to the reliability of threat intelligence workflows. Administrators are urged to prioritize the update to the latest patched version of MISP to ensure that event modification authorization checks are consistently enforced across all deletion paths. Failure to patch may result in unauthorized data loss that could compromise the effectiveness of the entire security operations center.