CVE-2026-103235

Name of the Vulnerable Software and Affected Versions MISP versions prior to 2.5.48

Description A mass assignment issue exists in the event delegation feature. When a user with delegation permissions submits a request, the application validates the user against the event in the URL but persists the entire submitted record, including caller-supplied fields such as the primary key and event id. An authenticated attacker with the perm delegate permission can inject a primary key or event id into the delegation payload to retarget an existing delegation record to any event on the instance. This allows unauthorized read access to events belonging to other organizations. If the target organization accepts the delegation, event ownership is transferred and the original record is deleted. This requires the MISP.delegation server setting to be enabled.

Recommendations Update to version 2.5.48 or later.