Authenticated users can query object reference data by UUID through EventGraphTool::get_reference_data() without verifying that the user is authorized to view the parent object. This flaw allows an attacker to read references that belong to objects outside the user’s access scope, exposing potentially sensitive information about events, incidents, or other data. The vulnerability is a classic example of missing authorization (CWE-862) and inadvertent correlation through an opaque identifier (CWE-639).

The flaw exists in MISP versions up to and including 2.5.45. Users employing older releases should consider them at risk.

The CVSS score of 5.3 indicates a moderate severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting that exploitation is not yet widely known. However, because the attacker must be authenticated and knows or can discover a valid reference UUID, the threat is limited to users with legitimate credentials who exploit the lack of ACL checks. Once a UUID is known, the attacker can retrieve the reference data for any object the UUID points to, regardless of the object's parent access restrictions.