The vulnerability occurs when the event flattening feature removes the Object containment from a query and returns attributes from objects as if they were top‐level event attributes. The application fails to reapply the object‑level distribution and sharing‑group access controls to those attributes. An authorised user who can view a community‑distributed event can therefore obtain attributes that belong to objects marked organisation‑only (distribution level 0) or restricted to a specific sharing group, even when the user’s organisation has no permission to see those objects. The result is an unauthorized disclosure of sensitive threat intelligence data. The issue was fixed by re‑applying the distribution ACL as a sub‑query condition on the Attribute.object_id field during flattening, and later refining the gate to use only the distribution ACL to avoid soft‑delete filtering problems.

MISP instances of version 2.5.47 and older. The affected product is the open‑source MISP platform with the event flattening functionality enabled.

The weakness is a classic example of an access control bypass (CWE‑285) combined with improper authorization checks (CWE‑862). The CVSS score of 7.1 indicates a high severity. EPSS data is not available, and the vulnerability has not been listed in CISA KEV. Attackers would need to be authenticated and have access to at least one community‑distributed event that contains restricted objects; the exploit would involve sending a normal event query with the flatten option enabled. The attack path is internal to the application and does not require external network access beyond normal operation.