MISP's decaying model import endpoint was intended to create new models exclusively for the importing user's organization with the default flag disabled. However, only top-level id and uuid fields were stripped, while nested model keys containing their own primary key, organization identifier, and default flag were not properly validated. This allowed users with decaying-model permissions to overwrite existing models from other organizations, alter model parameters, reassign ownership, and set models as the organization's default, thereby impacting scoring behavior.

An authenticated user with decaying-model permissions can overwrite or modify decaying models belonging to other organizations, potentially changing model names, formulas, parameters, ownership, and default status. This can affect the integrity and scoring behavior of decaying models used by other users within those organizations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is confirmed, restrict decaying-model permissions to trusted users only and monitor import activities closely.