The vulnerability in MISP's event delegation feature allows an authenticated user with delegation permission to submit a delegation request that includes caller-supplied fields such as primary key and event_id. The application authorizes the user against the event in the URL but persists the entire submitted record, enabling the attacker to retarget delegation records to any event on the instance. This grants read access to arbitrary events belonging to other organizations and can lead to event ownership transfer if the target organization accepts the delegation. The vulnerability affects MISP versions before 2.5.48 and requires the MISP.delegation server setting to be enabled.

An attacker with delegation permission can gain unauthorized read access to any event on the MISP instance, violating confidentiality. Additionally, the attacker can overwrite existing delegation records and transfer event ownership, impacting data integrity. This could lead to unauthorized data exposure and manipulation of event ownership across organizations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict delegation permissions to trusted users only and consider disabling the MISP.delegation server setting if not required.