MISP is vulnerable to an authorization bypass that allows authenticated users to access and modify unauthorized report data across event boundaries.

This is an improper access control vulnerability (CWE-639) where the application fails to verify ownership of a report identified by its UUID during an edit operation. The vulnerability is exploitable by any authenticated user who possesses editor-level access to at least one event.

The ability to manipulate reports across event boundaries poses a significant risk to the integrity and confidentiality of sensitive threat intelligence. An attacker could exfiltrate private data or corrupt existing reports, potentially compromising the efficacy and trust of the entire intelligence platform. While the CVSS score is 6.4, the potential for unauthorized access to sensitive intelligence mandates prompt remediation.

Immediate Action: Update the MISP instance to version 2.5.47 or later to implement the required ownership validation logic.

Proactive Monitoring: Review audit logs for suspicious activity involving report UUIDs or unauthorized attempts to modify events by users with editor privileges.

Compensating Controls: Strictly enforce the principle of least privilege by auditing editor permissions and ensuring that only trusted users have the capability to create or edit reports.

Public Exploit Available: Unknown

Organizations utilizing MISP must prioritize the update to version 2.5.47 to prevent unauthorized cross-event data access. Given the nature of the platform as a repository for sensitive threat intelligence, maintaining strict access control integrity is essential for operational security.