MISP’s object editing process improperly validates the sharing_group_id when combining object fields into the top layer, allowing a user with edit rights to attach an object or its attributes to any sharing group, regardless of their permissions. The flaw also bypasses per-attribute validation for embedded attributes, enabling further unauthorized distribution. An attacker can craft requests that set a distribution level of 4 with a chosen sharing_group_id, thereby revealing information about hidden sharing groups and altering the intended distribution metadata of objects.

The vulnerability impacts the MISP platform from the vendor misp. No specific version ranges are detailed in the data, so any deployment using the affected object handling code may be affected until patched.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score is unavailable, so the current likelihood of exploitation is uncertain. The vulnerability is not listed in the CISA KEV catalog. Because the flaw exists in the request handling path for authenticated users with edit permissions, the most likely attack vector is a remote authenticated request to the object edit endpoint. This inference is drawn from the description stating the issue arises during object editing.