MISP CVE-2026-103659

Requires (1) an authenticated MISP user account whose organisation has access to a community-distributed event, and (2) that event must contain at least one object with a more restrictive distribution level (organisation-only, level 0) or a specific sharing-group restriction than the event itself, and (3) use of the event 'flatten' option when fetching the event (API or UI). Exploitation is limited by the PR:L authentication requirement and by the data-dependency: events without restricted-object attributes leak nothing. Instances are only affected on MISP versions below 2.5.48 that use community/sharing-group distribution with object-level restrictions.

This is a genuine but access-gated information-disclosure flaw, not a high-urgency internet-wide threat. The vendor CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N, 7.1) is internally consistent with the description: network-reachable (AV:N), low attack complexity (AC:L), but requiring an authenticated account (PR:L) that already holds access to a community-distributed event, with pure confidentiality impact (VC:H) and no integrity or availability effect. No EPSS score, no CISA KEV listing, and no public POC are present in the supplied data, so exploitation status is 'no public exploit identified at time of analysis' - this should be treated as an unexploited, defense-in-depth disclosure bug. The signals do not conflict: a mid-7 CVSS driven entirely by high-value data confidentiality (threat-intel leakage between organisations) is reasonable, but the PR:L gate and the requirement that an event actually contain object-level restricted attributes meaningfully narrow real-world exploitability. There is no evidence this is being targeted; prioritise patching for multi-tenant/community MISP instances but it does not warrant emergency out-of-band response.

An authenticated MISP user from one member organisation requests a community-distributed event using the flatten option via the API or UI. Because the flattening code path drops the Object containment and never re-applies the object-level distribution/sharing-group ACL, the response surfaces attributes from organisation-only (distribution 0) or sharing-group-restricted objects that the user's organisation was never entitled to see, leaking another organisation's threat intelligence. No public exploit code is identified; exploitation only requires toggling the existing flatten parameter, so attack complexity is low once a valid account exists.