MISP Guard, a proxy enforcing security policies on MISP feed data, has a vulnerability where it incompletely validates required taxonomy tags. The guard verifies only that at least one tag from a required taxonomy is allowed but fails to ensure all tags from that taxonomy are allowed. This flaw allows events or attributes to carry both allowed and non-allowed tags simultaneously, bypassing data classification restrictions and potentially exposing sensitive data to unauthorized feed consumers. The issue affects event-level and attribute-level tag validation, including nested and shadow attributes. An attacker able to modify MISP events in a feed source can exploit this to leak higher-classification data through feeds intended for lower-classification data. The vulnerability has a CVSS 4.0 base score of 6.1 (medium severity). No patch or fix information is provided.