An authorization bypass vulnerability in MISP allows authenticated users to read or modify unauthorized event reports, posing a significant risk to data integrity and confidentiality.

This vulnerability is an insecure direct object reference (CWE-639) located in the processModuleResultsData method of the Event model. An authenticated user with permissions to submit module results can inject an existing report ID into their request, causing the application to overwrite or disclose sensitive data from other events.

The ability to overwrite or reassign ownership of event reports could lead to the corruption of threat intelligence data and the unauthorized disclosure of sensitive security incidents. With a CVSS score of 8.3, this flaw represents a high-severity risk to organizational security operations, as it compromises the core integrity of the threat intelligence platform.

Immediate Action: Upgrade MISP to version 2.5.47 or later to implement the necessary input validation that strips client-supplied ID fields during report processing.

Proactive Monitoring: Review application logs for unusual module result submissions and monitor EventReport audit logs for unexpected changes to report ownership or content.

Compensating Controls: Restrict permissions for executing module result processing to a minimal set of trusted users until the software can be patched.

Public Exploit Available: Unknown

Given the potential for unauthorized modification of critical threat intelligence, organizations should prioritize updating to version 2.5.47 immediately. Failure to address this vulnerability allows malicious actors or compromised accounts to manipulate historical and ongoing security data, which could blind security teams or lead to the exposure of sensitive incident information.