The vulnerability in MISP involves an authorization bypass in the attribute creation endpoint. Authenticated users permitted to add attributes could submit a sharing_group_id without triggering the sharing group authorization check if the attribute distribution was not set to the specific value '4' (sharing group). This allowed users to reference or associate attributes with sharing groups they were not authorized to access, compromising the integrity of attribute sharing metadata and potentially exposing or misusing restricted sharing group relationships. The fix ensures that the sharing group permission check is enforced whenever a non-empty sharing_group_id is provided, regardless of the distribution value.

This vulnerability allows an authenticated user with attribute creation permissions to bypass sharing group authorization checks, potentially associating attributes with unauthorized sharing groups. This could compromise the integrity of sharing metadata and lead to exposure or misuse of restricted sharing group relationships within MISP.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described patch changes the authorization logic to enforce sharing group permission checks whenever a non-empty sharing_group_id is provided. Until an official fix is confirmed, users should restrict attribute creation permissions and monitor for unauthorized sharing group associations.