MISP has a mass assignment vulnerability in its event delegation feature affecting versions prior to 2.5.48. Authenticated users with delegation permission can manipulate delegation records to gain unauthorized read access to arbitrary events and potentially transfer event ownership. This vulnerability allows overwriting existing delegation records and unauthorized event access across organizations.