PT-2026-85444 · Misp · Misp
CVSS v4.0
8.3
High
| Vector | AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
MISP (affected versions not specified)
Description
An incorrect authorization flaw allows authenticated users to delete attributes from events without possessing the required
perm modify or perm modify org permissions. The issue occurs because the MispAttribute::deleteAttribute() function performs organization membership checks but fails to consistently enforce event modification authorization rules. This creates a discrepancy where attribute editing is correctly restricted via ACL::canModifyEvent(), but deletion operations can bypass these checks. An authenticated attacker who is a member of the organization owning an event can exploit this to remove individual or bulk attributes, leading to unauthorized modification or loss of threat intelligence data.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Incorrect Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Misp