MISP’s proposal visibility granted any user belonging to a sharing group without checking the attribute’s distribution level. The flaw also prevented an owning organization from seeing proposals on its own attributes, creating an over‑restrictive behavior. As a result, users who should not see certain proposals could view them, exposing potentially sensitive data.

The vulnerability affects the MISP platform, specifically all releases prior to 2.5.48. Users of the open‑source MISP application must verify whether they are running a vulnerable version and plan for an upgrade.

The CVSS score of 7.1 indicates a moderate to high severity. The EPSS score is not available and the issue is not listed in the CISA KEV catalog, but the opportunity for abuse remains; an attacker only needs to be part of a sharing group or rely on an organization’s internal users to benefit from the data exposure. There is no public exploit noted, but the flaw is straightforward to exploit once the sharing group membership is known.