Affected versions of MISP (≤2.5.45) contain improper authorization checks in the freetext feed preview feature. The preview performs correlation lookups against event attributes without enforcing the requesting user's access control lists (ACLs), allowing exposure of restricted event correlations and associated event data. Additionally, cross-feed correlation results include metadata for feeds not marked as lookup_visible, sometimes exposing feed URLs unnecessarily. The vulnerability stems from queries scoped only by attribute values and deletion status, ignoring event, organization, sharing-group, attribute, and object-level access controls. The fixes apply the caller's ACL to correlation searches, remove feed URLs from results, restrict cross-feed results based on feed visibility, and correct host-organization ID comparisons to enforce authorization consistently.

Users with limited privileges can access event correlations and feed metadata that should be restricted, potentially exposing sensitive or confidential event information and feed configuration details. This unauthorized data exposure could lead to information disclosure within the MISP platform. There is no indication of privilege escalation or remote code execution. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is applied, restrict access to the freetext feed preview functionality to trusted users only or disable this feature if possible. Monitor vendor channels for official patches addressing this authorization issue.