MISP’s object‑synchronization component enforces a validation rule that rejects objects with an empty description. When an object legitimately created without a description is replicated to a peer instance, the receiving instance discards the object and all its attributes. The result is a silent loss of threat‑intelligence records, compromising the integrity of the shared data set. The flaw does not allow external exploitation; it is triggered only when an authorized user creates an object without a description and that object is subsequently synchronized.

The affected product is MISP. The vulnerability exists in installations with a version older than 2.5.48. Users running any pre‑2.5.48 release of MISP should consider applying the listed fix.

The CVSS score of 5.3 indicates a moderate severity and the EPSS score is not available, implying no known widespread exploitation. The vulnerability is not in the CISA KEV catalog. Because the flaw requires an authorized user to create an object with an empty description and a synchronized peer, the risk is limited to environments where such configurations exist. The likely attack vector is an internal action by a user who creates objects without descriptions; no external attacker can trigger the defect without legitimate privileges.