MISP EUVD-2026-91748

Requires (1) an authenticated MISP account with access to at least one event, and (2) the existence of correlation-table entries linking that accessible event to other events the caller is not permitted to open - i.e. events that are unpublished, or whose distribution level or sharing-group membership changed after the correlation was recorded. The vulnerable path is the related/correlated events listing feature, which trusted the correlation table's stale distribution/sharing-group snapshot (and lacks a published flag) instead of re-validating each target event. Limiting factors: exploitation yields metadata only (titles, dates, correlation counts), never attribute payloads; it is useless if no cross-boundary correlations exist; and it requires valid authentication, so exposure is bounded to existing community members rather than anonymous internet attackers.

This is a genuine but low-to-moderate priority issue, not a high-CVSS scare. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) with only VC:L and no integrity or availability impact yields a score of 5.3 (Medium), and that rating is well-calibrated: the flaw (CWE-862, Missing Authorization) leaks only event metadata - titles, dates, and correlation value counts - never the underlying attribute/IOC data. It is network-reachable and low-complexity, but requires an authenticated account (PR:L), so it is not an unauthenticated internet-facing bug. No EPSS score, CISA KEV listing, or POC was provided, consistent with no public exploit identified at time of analysis; there is no signal of active exploitation. The practical risk is confidentiality-only reconnaissance within a trust community (e.g., a member of one sharing group inferring the existence and timeline of events in groups they were excluded from). No data is strongly conflicting; the main caveat is that exploitation is entirely contingent on correlation entries existing between the attacker's accessible event and restricted events, which is deployment-dependent and cannot be confirmed from the input.

An authenticated MISP user with access to even a single event requests that event's related/correlated events listing; the application reads related-event metadata straight from the correlation table without re-checking the caller's rights against each target event. The user thereby learns titles, dates, and correlation counts of unpublished events or events whose distribution/sharing group has since been restricted. No public exploit code is identified; the attack needs no special tooling beyond normal authenticated UI/API use.