MISP EUVD-2026-91751

Requires an authenticated MISP account with at least read access to some events (PR:L - not exploitable unauthenticated). Exploitation further depends on a specific state: correlations must exist between events, and at least one correlated event must have been restricted (its sharing group changed or it was unpublished) AFTER the correlation row was created, so the stale distribution snapshot diverges from the live ACL. Limiting factors: site-admin users are unaffected by the flawed snapshot path (the fix explicitly exempts perm_site_admin), the attacker cannot choose which data leaks (it is bounded to whatever correlated events were later restricted), and impact is confined to confidentiality - read-only exposure of attribute values and event metadata.

This is a moderate-severity broken-authorization issue (CWE-862) in MISP, best treated as a measured-priority patch rather than an emergency. The vendor-provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and a Confidentiality-only impact (VC:H, VI:N, VA:N) are internally consistent with the description: an authenticated, low-privilege user can read data over the network with low complexity, but there is no integrity or availability impact. My independent assessment agrees with PR:L - exploitation genuinely requires a valid account, so this is not unauthenticated. The real-world risk is tempered by meaningful preconditions beyond the raw vector: correlations must already exist and at least one correlated event must have been restricted (sharing group changed or unpublished) AFTER the correlation row was written, so exploitation depends on a specific sequence of events rather than a default-exploitable condition. No EPSS score was provided, there is no CISA KEV listing, and no public POC was identified - only a vendor patch commit. The signals are consistent (no conflicting data), pointing to a legitimate confidentiality flaw that warrants patching but shows no evidence of active or imminent widespread exploitation. Note the input Tag 'Authentication Bypass' overstates the issue: this is a post-authentication authorization/access-control failure, not a login bypass.

An authenticated MISP user with read access to some events performs an attribute search that triggers correlation lookups. Because the correlation row stores a stale point-in-time distribution snapshot (with no published flag) instead of consulting the live event ACL, the user is served attribute values and event metadata from a correlated event that was subsequently restricted or unpublished - data they are no longer authorized to view. No public exploit code was identified at time of analysis.