A critical authorization bypass vulnerability in the MISP UiBeta theme allows authenticated users to access unauthorized event data, posing a significant risk to data confidentiality.

This vulnerability is a missing authorization flaw (CWE-862) located in the UiBeta theme collection view template. An authenticated user can trigger a secondary query that bypasses the standard access control list filters, allowing them to retrieve event details, tags, and galaxy clusters they are not permitted to see.

The exploitation of this vulnerability results in horizontal privilege escalation, allowing unauthorized access to sensitive threat intelligence data. Given the CVSS score of 7.1, this flaw presents a high risk to organizations relying on MISP to manage classified or sensitive security information, as it compromises the confidentiality of event boundaries and could lead to unauthorized information disclosure.

Immediate Action: Update the MISP instance to a version containing the fix, or apply the official patch from the vendor repository (commit 44573e4a8).

Proactive Monitoring: Review application access logs for unusual patterns in collection viewing behavior or unexpected retrieval of event data by low-privileged user accounts.

Compensating Controls: Restrict access to the affected collections feature or limit the visibility of sensitive events until the patch can be verified and deployed across the production environment.

Public Exploit Available: Unknown

Organizations should treat this vulnerability with high priority, especially those handling sensitive threat intelligence. Administrators must ensure the vendor patch is applied to the view template to enforce proper ACL checks, thereby closing the authorization gap. Regular audits of user permissions and access logs are recommended to maintain the integrity of the MISP platform.