The vulnerability lies in MISP’s interactive CLI shell, which implements its own access control logic separate from the web application’s authorization model. This discrepancy allows attackers with CLI access to bypass ACL checks and view data they should not see, including credential headers and synchronization authkeys. The flaw also permits context establishment for records without verifying read permissions, potentially exposing sensitive information and facilitating manipulation of data in a way that the web UI would block. This weakness includes terminal injection that can compromise confidentiality and integrity of sensitive data.

Systems running MISP versions up to and including 2.5.45 are impacted, particularly environments that enable the interactive CLI shell for administrators, coordinators, or other users with network access to the MISP server. Any vendor that has adopted the default shell configuration before the referenced fix is susceptible.

The CVSS score of 8.4 classifies the flaw as high severity. Although EPSS data is not available, the custom ACLs make exploitation plausible for attackers with network access to the CLI endpoint. The CISA KEV list does not flag this vulnerability, but the existence of an unaddressed authorization mismatch presents a significant risk to all affected systems due to potential data leakage and privilege escalation. Attackers likely need to authenticate to the shell, then issue feed or entity commands to fetch sensitive data; the exposed CLI logic permits this without further checks. The lack of mitigation in the CLI out-of-the-box config means any compromise of the shell credentials directly translates to data exposure without interception.