MISP’s UiBeta theme collection view performed a secondary query of member events by UUID without applying the caller’s access control list (ACL). The controller correctly filtered events, but the view template re‑queried based on event UUIDs only, omitting the createEventConditions authorization filter. As a result, any authenticated user who could view a collection could also retrieve full details of events they were not authorized to read, including identifiers, dates, creator organization, tags, and galaxy clusters. This constitutes an authorization bypass at the presentation layer that allows horizontal privilege escalation across event boundaries within the MISP instance.

The vulnerability affects the MISP platform when the UiBeta theme is in use. All deployments of MISP that include this theme and have not applied the referenced patch are impacted. No specific version numbers are listed, implying that any instance using the unpatched UiBeta view template is vulnerable.

The CVSS score of 7.1 indicates medium‑to‑high severity. EPSS is not available and the issue is not listed in CISA’s KEV catalog, suggesting limited public exploitation to date. Attacks require an authenticated user with view access to at least one collection; exploitation is therefore confined to legitimate users who can navigate to the collection view. The attacker can then trigger the secondary query, exposing sensitive event data that would normally be protected by ACL checks. Prompt patching is needed to restore proper authorization filtering at both controller and view layers.