MISP's tag collection creation and editing functions accept the full HTTP request payload and pass it to a bulk-association save operation that indiscriminately writes all associated model data present. A user with tag editor permission can craft requests that inject additional model data such as User or Organisation records, which are then saved to the database. This enables unauthorized modification or creation of privileged accounts, resulting in privilege escalation to site administrator. The vulnerability requires an authenticated account with tag editor permission and network access to the MISP instance. It affects versions before 2.5.48.

An attacker with tag editor permissions can escalate privileges to site administrator by injecting unauthorized User and Organisation data into the system. This compromises the integrity of user accounts and organizational records, potentially allowing full administrative control over the MISP instance.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict tag editor permissions to trusted users only and monitor for suspicious activity related to tag collection creation and editing.