CVE-2026-104908: MISP Decaying Model Import Mass Assignment Allows Cross-Organization Model Overwrite and Default Flagging
MISP contains an improper input validation vulnerability in the decaying model import functionality. The import endpoint was intended to create a new decaying model belonging exclusively to the importing user's organisation, with the default flag forced to off.
However, the application stripped only the top-level id and uuid fields and pinned orgid and default on the outer array before saving the data flat. A user with decaying-model permissions could supply a nested model key carrying its own primary key, organisation identifier, and default flag, which bypassed those guards during the save operation.
Impact:
- A user with permdecaying could overwrite an existing decaying model belonging to another organisation in place, altering its name, formula, parameters, or ownership.
- A user could create or modify a model flagged as the organisation default, affecting scoring behaviour for other users.
- A user could reassign a model's organisation to an arbitrary value.
Preconditions:
- Authenticated user with decaying-model permission (permdecaying).
- Network access to the MISP instance.
Affected: <2.5.48.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MISPto a version that resolves this vulnerability.Fixed in 2.5.48
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated to the MISP instance, have network access to it, and hold the perm_decaying permission. Users without that permission are not described as able to use the vulnerable import functionality.
Can this affect other organisations?
Yes. A permitted user can overwrite an existing decaying model from another organisation, including its name, formula, parameters, and ownership. They can also assign a model to an arbitrary organisation.
What configuration impact can an attacker cause?
The attacker can create or modify a decaying model with the organisation-default flag enabled. This can change scoring behaviour for other users in that organisation.
Which versions are affected?
MISP versions earlier than 2.5.48 are affected.