The vulnerability in MISP involves an authorization bypass in the related events listing feature. When a user requests related events for a given event, the system returns metadata from a correlation table without verifying the user's access rights against each related event. Since the correlation table stores snapshots of event distribution and sharing groups but lacks the published flag, events that are unpublished or have changed access controls since correlation creation may be disclosed. This allows unauthorized users to see metadata such as event titles, dates, and correlation counts for events they should not access. The issue requires an authenticated user with access to at least one event and the presence of correlation entries linking to unauthorized events. The vulnerability is fixed in commit 2ffa97f05.

Unauthorized users can gain access to metadata of events they are not permitted to view, including event titles, dates, and correlation counts. This unauthorized disclosure can facilitate reconnaissance of threat intelligence event names and timelines across sharing groups, potentially aiding attackers or unauthorized parties in gathering sensitive intelligence information.

A fix for this authorization bypass vulnerability is available in MISP as of commit 2ffa97f05. Users should update to the fixed version to ensure proper access control validation when listing related events. No additional mitigation steps are indicated beyond applying the official fix.