The vulnerability arises when MISP’s event‑deletion routine fails to cascade remove child records such as report tags, graph entries, shadow attribute correlations, SSDEEP chunks, and attachment scan results. As a result, orphaned database entries containing potentially confidential threat‑intelligence data persist after the parent event is deleted. This violates data‑integrity policies and can lead to unintended disclosure if those orphaned records are accessed through other application queries or administrative interfaces. The weakness is identified as CWE‑459.

The defect is present in the MISP platform, specifically in versions prior to 2.5.48. The upstream fix was committed to the repository (commit 5f78634af) and is included in releases 2.5.48 and later.

The CVSS score of 5.1 indicates medium severity. Exploitation requires an authenticated user with permission to delete events, which limits the attack surface to privileged accounts. No publicly documented remote vector exists and the EPSS score is unavailable, suggesting a moderate probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog, but the presence of residual sensitive data remains a real risk whenever privileged deletion operations occur.