MISP Guard, the proxy that enforces security policies on MISP feed data, performed incomplete validation of required taxonomy tags. When a feed event or its attributes carried tags from a required taxonomy, the guard only verified that at least one tag matched the configured whitelist. It did not check that every tag from that taxonomy was allowed, so an event could carry both an allowed tag (for example, tlp:clear) and a disallowed tag (such as tlp:red or tlp:amber) and still pass the guard. The result was that higher classified or more sensitive data could be distributed through feeds that were intended to expose only lower‑classification data, effectively bypassing the intended data‑handling restrictions.

The vulnerability applies to MISP Guard deployments, specifically the misp-guard component. Any instance of MISP Guard that processes events containing required taxonomy tags such as TLP is susceptible. Users who author or modify events in a feed source that is protected by MISP Guard could exploit the flaw.

The CVSS score is 6.1, indicating medium severity. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalog. The attack requires the adversary to create or modify events in a feed source that is protected by MISP Guard. If the attacker can add disallowed tags alongside allowed tags, they can exfiltrate more sensitive data than the policy permits. The form of the vulnerability is an input validation failure (CWE‑20) combined with improper authorization enforcement (CWE‑285).