The vulnerability is an authorization flaw within MISP’s OnDemand correlation engine. Correlations were computed solely from matching attribute values without checking distribution, sharing group, organization, or other access‑control restrictions. As a result, an authenticated user could request correlations that reference attributes or events the user was not authorized to see, leading to a confidentiality breach. The weakness corresponds to CWE‑862, a missing authorization failure.

The affected product is the MISP platform, commonly known as the Malware Information Sharing Platform & Threat Sharing. All versions that include the OnDemand correlation engine and do not yet incorporate the patch – specifically the commit that adds user‑aware filtering – are vulnerable. No explicit version list is provided, so any MISP installation prior to the patch is considered affected.

The CVSS score of 5.3 indicates a medium severity risk. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. The flaw requires only that the attacker be an authenticated user; even a low‑privileged account can trigger the correlation engine and receive results that include restricted data. The attack path involves authenticating to MISP, creating or querying an attribute that causes the engine to compute correlations, and then receiving a response containing attributes or events the user is not allowed to access. The implemented fix inserts the current user into the correlation collector and filters correlation identifiers through MISP’s existing fetchAttributesSimple() logic, thereby restoring proper authorization checks and preventing the disclosure.