An authenticated MISP user can submit a sharing_group_id to create or edit attributes or Galaxy clusters without the system verifying that the user is permitted to use that group. The flaw allows the user to associate data with a sharing group they are not authorized for, potentially exposing data to unintended recipients and violating information‑sharing boundaries. The weakness is a classic authorization bypass, identified as CWE-862.

The vulnerability exists in MISP servers handling attribute attachment and Galaxy cluster creation and editing workflows. Any MISP deployment that processes sharing_group_id values without validating the requesting user's permissions for that group is affected. No specific version numbers are listed, so all active installations that use the described functionality are potentially impacted.

The CVSS score of 7.6 classifies the issue as high severity, and the vulnerability is exploitable by any user who has the ability to create or edit the affected objects. An attacker can craft a request that omits or modifies the distribution field while submitting a sharing_group_id, causing the authorization check to be bypassed. The lack of a public EPSS score and the absence of a CISA KEV listing do not eliminate the risk, as the flaw remains actionable within trusted MISP environments. Patched versions require a non‑empty sharing_group_id to trigger the proper authorization check and reject empty identifiers.