A vulnerability in MISP allows an attacker to create a collection element that references an event or galaxy cluster by its UUID without verifying that the user has permission to read that object. The missing authorization gate lets a malicious actor persist a UUID pointing to another organisation’s private data. Once the collection is viewed, the referenced object is resolved and can be exposed to users who should not have access, leading to confidentiality leakage of sensitive MISP content.

The issue affects all MISP installations using a version 2.5.45 or earlier. Administrators should verify that the product is upgraded beyond this release or apply the upstream commit that introduces the __assertCanUseElements() guard in the add() CRUD path and addElementToCollection() method.

The vulnerability carries a CVSS score of 7.1, indicating high severity, but its EPSS value is below 1% and the flaw is not listed in the CISA KEV catalogue, so the current probability of exploitation is low. Attackers could exploit the flaw by crafting an API or web request that submits a bare UUID to the collection add endpoint. If successful, the system will silently store the reference, and later legitimate list or view operations will resolve the UUID and expose the underlying object to unauthorised viewers. Because the flaw operates before authorization checks, it bypasses normal ACL controls and can be used to leak private data to any party who can add collection elements.