The ACLComponent contains a typo that causes the previewEventAttributes action to reference the permission string 'theming_enabled*' instead of the intended 'theming_enabled'. Because the malformed key does not match any valid permission, the authorization check for this endpoint can fail in a way that allows users without the correct permission to access the data or, depending on the ACL evaluation order, can deny legitimate users access. The endpoint exposes event attribute data, so an authorization bypass could expose sensitive indicators and attribute information to users who should not see them.

The vulnerability affects the MISP software product. No specific version information is listed in the CNA data, so all releases should be examined until a fix is applied.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score is not available, meaning we have no insight into the current probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector involves an authenticated user inside the MISP instance; a malicious or compromised user could exploit the ACL typo to read data. If access is denied for legitimate users, availability of the previewEventAttributes endpoint is also harmed. The exploitation requires only the presence of the malformed ACL configuration and does not rely on external network vulnerabilities.