CVE-2026-104908

Name of the Vulnerable Software and Affected Versions MISP versions prior to 2.5.48

Description Improper input validation exists in the decaying model import functionality. The import endpoint was designed to create a new decaying model restricted to the importing user's organization with the default flag disabled. However, the application only stripped top-level id and uuid fields and pinned org id and default on the outer array. An authenticated user with perm decaying permissions could provide a nested model key containing its own primary key, organization identifier, and default flag to bypass these restrictions during the save operation. This could allow a user to overwrite existing decaying models from other organizations, modify models flagged as organization defaults to affect scoring behavior, or reassign a model's organization to an arbitrary value.

Recommendations Update to version 2.5.48 or later.