MISP EUVD-2026-104127

Requires a valid, authenticated MISP account that is a member of at least one sharing group, and that sharing group must be attached to the target attribute or object. Under those conditions the user can view proposals on attributes/objects carrying that sharing group regardless of the attribute's distribution level (levels 1-3 should have restricted visibility). Limiting factors: no anonymous/unauthenticated access is possible (authenticated per PR:L), the attacker must specifically share a group with the targeted data, and the impact is read-only disclosure of proposal data with no write/modify capability. A secondary functional bug (the owning organisation being unable to see proposals on its own org-only attributes) is a usability/availability-of-data regression, not an attacker-exploitable confidentiality issue.

This is a genuine but moderate-priority issue rather than an urgent one. The vendor-supplied CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N, score 7.1) shows network reachability and low attack complexity, but critically requires PR:L - the attacker must already be an authenticated MISP user who belongs to a sharing group attached to the target data. Impact is confidentiality-only (VC:H, with VI/VA:N), consistent with CWE-862 missing authorization: it leaks proposal data, it does not let an attacker modify or destroy anything. No EPSS score, no CISA KEV listing, and no public exploit code were provided, so by the precision rules this is 'no public exploit identified at time of analysis' - there is no signal of active or widespread exploitation. The realistic threat model is a malicious or curious insider (a legitimate sharing-group member) seeing proposals they should not, not mass internet exploitation. One note of divergence: the vendor rated confidentiality VC:H, but the disclosure is scoped to proposals (shadow attributes) on attributes/objects already within the user's sharing groups, which reads closer to a limited/partial disclosure than a total confidentiality loss - this is a judgment call worth verifying against the data sensitivity of a given MISP instance. Overall: patch on a normal cadence; prioritize higher only for instances with untrusted or large sharing-group memberships.

An authenticated MISP user who is a member of a sharing group browses or queries proposals (shadow attributes) on attributes or objects carrying that sharing group. Because the authorization check validated sharing-group membership without checking the attribute's distribution level, the user is shown proposed attribute changes that distribution levels 1-3 should have hidden from them. No public exploit code is identified; exploitation requires only a valid account and normal application use.