MISP had to fix more than ordinary authorization bugs. Logged-in users could overwrite, re-scope, or delete records that belonged to other organizations, and privileged site admins could push configuration access into code execution.
NCSC’s advisory covers six CVEs in the MISP platform: client-supplied key manipulation, session fixation, authorization bypass, improper bulk deletion, and two admin-to-code-execution paths. The fix adds server-side validation, stricter authorization, and limits on log and configuration locations.
For operators, the broken assumption is that authenticated access stays inside one role or one tenant. In MISP, the management plane itself becomes the blast radius when those trust checks fail.