The vulnerability arises from a logic flaw in MISP's event synchronization. Non‑exportable tags were filtered only once after all event reports were gathered, so all but the final report were sent to the remote instance with restricted tag data. This results in unauthorized disclosure of information that the source instance intended to keep private, impacting confidentiality of data that may be sensitive or classified.

Affected systems are MISP installations configured to push events consisting of multiple reports to a remote MISP server. Versions prior to 2.5.48 are vulnerable, as the patch that corrects the filtering is introduced in that release. Any instance that has event sync enabled with a remote endpoint may expose its non‑exportable tag schema to the partner node.

The CVSS score of 5.3 places this in the medium severity range; the EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation would require an attacker who can create or compromise a remote MISP instance that receives synchronized events. Once the event is transferred, the attacker can read the formerly non‑exportable tags, potentially revealing sensitive classification or internal categorization. No known public exploits exist, but the impact may be significant for environments relying on tag isolation for confidentiality.