MISP contains an improper input validation vulnerability in its ORM save path that allows an authenticated user with low-level write permissions to manipulate nested input data. This flaw enables attackers to overwrite, re-parent, or soft-delete database rows belonging to other organizations or events without read access. The vulnerability affects multiple entity types including Attribute, Object, EventReport, Sighting, AttributeTag, and ShadowAttribute. It impacts versions prior to 2.5.48.