The vulnerability exists in MISP’s CryptographicKeysController::view endpoint. The code retrieves cryptographic keys directly using the supplied key ID and returns sensitive fields such as type, key_data, and fingerprint. It does not verify that the caller has permission to view the parent event that owns the key. Consequently, any authenticated user can request any key ID and obtain the signing key of a protected event, which could allow an attacker to forge or tamper with event signatures. This falls under CWE‑639 and CWE‑862.

MISP installations running version 2.5.45 or earlier are affected. The default configuration of the CryptographicKeysController enables the view action for all authenticated users. Thus, any user with account privileges (but not necessarily administrator) can trigger the disclosure. The vulnerability is present in the MISP product on all operating systems and platforms that host the application.

The CVSS score of 7.1 indicates high severity. The exploit requires only network access and user authentication; there is no requirement for privileged code execution or local privileges. Because the request is a simple HTTP GET to /cryptographicKeys/view with a key ID, attackers can automatically enumerate keys. EPSS data is not available, but the lack of authorization makes the vulnerability readily exploitable. The vulnerability is not yet listed in CISA KEV. Organizations using MISP should treat this as an elevated risk for any authenticated user base.