MISP does not enforce granular authorization when a regular user adds a reference between objects or attributes. While it verifies that the user can view the overall event, it fails to confirm that each referenced attribute or object is within the user’s permitted distribution or sharing group. This oversight allows a user who has access to an event to retrieve sensitive attributes, object details, or related object data that should remain hidden, effectively creating an unauthorized disclosure of restricted information. The weakness aligns with CWE-862: Authorization Bypass Through Privilege Exhaustion.

The issue affects installations of MISP that permit authenticated non-site administrators to add object references inside events they can view. No specific version is listed, but the vulnerability is fixed in commit f36634e57.

The CVSS score of 6.3 indicates a moderate severity. The EPSS score is not available, so the likelihood of exploitation is currently unknown, but the vulnerability is not listed in the CISA KEV catalog. The attack requires an authenticated non-admin user with read access to an event; the user then adds a reference that inadvertently exposes more detailed data. Because the application must be logged in to trigger the vulnerability, it is an authenticated insider threat scenario. The exploit does not provide remote code execution or denial of service, but it can lead to confidential data leakage that may violate privacy policies or regulatory obligations.