The vulnerability arises because MISP sanitizes the outer record by stripping primary keys and pinning event_id or object_id to the caller's context, but the ORM's set() method prioritizes nested keys matching the model alias. An attacker can embed a nested block under the model alias key with attacker-chosen id and event_id values, bypassing sanitization and allowing unauthorized modification of data across tenants. This requires only a low-privilege authenticated user with perm_add rights and affects multiple entity types. The affected versions are all versions prior to 2.5.48.

An attacker with low-privilege authenticated access can compromise cross-tenant data integrity by rewriting attribute values, re-parenting objects to attacker-controlled events, or soft-deleting rows belonging to other organizations or events. This undermines data isolation and integrity across tenants in MISP, potentially affecting multiple entity types.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict write permissions to trusted users and monitor for suspicious activity related to nested input data manipulation.