Authorization Bypass in MISP EventsController for Event Data Modification

CVE-2026-60124

What is CVE-2026-60124?

A security vulnerability in MISP's EventsController allows authenticated users and read-only API keys to modify event data, potentially jeopardizing the integrity of MISP event content. Specifically, the import module did not check for proper event modification rights before saving outputs in the misp_standard format. As a result, users with restricted access could inject or alter event data, leading to unauthorized changes. This issue has been mitigated by implementing necessary checks to validate user permissions before processing imports, ensuring that only authorized personnel can modify event information.

References