An insufficient authorization flaw in MISP allows authenticated users to bypass data access restrictions, potentially exposing sensitive intelligence within events.

This is a missing authorization flaw (CWE-862) occurring within the ObjectReferencesController. Authenticated, non-administrator users can view sensitive attributes or objects that should be restricted by sharing group or distribution level settings.

The ability for unauthorized users to view sensitive data within MISP compromises the integrity of intelligence sharing workflows. Given the CVSS score of 6.3, this medium-severity flaw poses a risk of data leakage, particularly in environments where granular access control is required to protect classified or proprietary threat intelligence.

Immediate Action: Update MISP to version 2.5.47 or later to implement the required granular authorization checks in the reference handling logic.

Proactive Monitoring: Audit access logs for unusual patterns of object reference creation or repeated attempts by non-privileged accounts to access specific event sub-elements.

Compensating Controls: Restrict user permissions to the minimum level required for their role and review sharing group memberships to limit the scope of potential data exposure until the patch is applied.

Public Exploit Available: Unknown

While this vulnerability requires an authenticated session, the potential for unauthorized access to sensitive threat intelligence is significant for organizations relying on MISP for secure data handling. Administrators should prioritize the update to version 2.5.47 to enforce proper security boundaries and prevent the inadvertent exposure of restricted objects.