CVE-2026-103237

Name of the Vulnerable Software and Affected Versions MISP versions prior to 2.5.48

Description An improper input validation issue exists in the ORM save path. When submitting data through endpoints such as attribute add/edit, event edit, free-text import, sighting capture, shadow attribute proposal, event report creation, object reference add, and user admin edit, the application sanitizes records by removing the primary key and pinning the event id or object id to the caller's context. However, the ORM set() method prioritizes a nested key matching the model alias, ignoring the outer scalar fields. An authenticated user with basic write permissions can embed a nested block under the model alias key to bypass sanitization, allowing them to use an attacker-chosen id and event id. This can lead to cross-tenant data integrity compromise, enabling the overwriting, re-parenting, or soft-deletion of rows belonging to other organizations or events, affecting entity types including Attribute, Object, EventReport, Sighting, AttributeTag, and ShadowAttribute.

Recommendations Update MISP to version 2.5.48 or later.