MISP EUVD-2026-94314

Exploitation requires an authenticated MISP user who holds write access to at least one existing event AND who edits that event's distribution level or sharing_group_id field - the stale-correlation leak only manifests on an update to one of those two specific fields, not on event creation or other edits. The disclosure is further limited to data for which correlations already existed and to users who were members of the previously broader sharing group, so impact depends on the event having pre-existing cross-event correlations. There is no remote unauthenticated path and no code execution; the harm is confined to incorrect visibility of correlated event data after a distribution/sharing-group change in MISP versions before 2.5.48.

This is a genuine-but-low-priority access control defect (CWE-284), and the signals are internally consistent rather than conflicting. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) with all vulnerable-system impacts set to None and only subsequent-system confidentiality Low (SC:L) correctly reflects a logic flaw that leaks event data indirectly rather than directly compromising the host - hence the modest 5.3 base score. PR:L confirms exploitation requires an authenticated user with event write access, which substantially narrows the threat population to existing trusted MISP collaborators, not anonymous internet attackers. No EPSS score, no CISA KEV listing, and no public POC were provided, which is consistent with a subtle correlation-refresh bug rather than a mass-exploited vulnerability. The honest conclusion: this is a correctness/data-governance issue with privacy consequences, not an urgent patch-now emergency - treat it as a scheduled upgrade priority for organizations that rely on sharing-group boundaries to segregate sensitive threat intelligence. One caveat: the input Tags label this 'Authentication Bypass,' which contradicts the PR:L vector and the description's explicit precondition of an authenticated write-capable user - this is a mislabeling, not a signal of auth-bypass risk.

An authenticated analyst reclassifies a sensitive event from a broad distribution/sharing group to a more restrictive one to limit who can see it. Because the before-save hook stored the incoming values instead of the previously persisted ones, the correlation engine never refreshes, so stale correlations continue surfacing the event's data to users in the original broader group - unintended disclosure across a boundary the operator believed they had tightened. No public exploit code is required or identified; the flaw is triggered through normal event-editing workflow.