Wenhao Wu

**Name of the Vulnerable Software and Affected Versions** MISP versions prior to commit 2ffa97f05 **Description** An authorization bypass exists in the related events listing functionality. When a user requests a list of events correlated to a specific event, the system retrieves metadata directly from the correlation table without re-validating the caller's access rights for each related event. Because the correlation table uses a snapshot of the distribution level and sharing group from the time of creation and lacks a published flag, metadata such as titles, dates, and correlating value counts may be disclosed for events that are unpublished or have updated access restrictions. This allows an authenticated user with access to at least one event to perform reconnaissance on threat-intelligence event names and timelines across different sharing groups. **Recommendations** Update to the version containing commit 2ffa97f05.

**Name of the Vulnerable Software and Affected Versions** MISP versions prior to 2.5.48 **Description** An authorization bypass exists in the event flattening feature. When a user requests an event with the flatten option enabled, the application removes the Object containment from the query and returns object attributes as top-level event attributes without re-applying object-level distribution and sharing-group access control checks. This allows an authenticated user with access to a community-distributed event to retrieve attributes from objects restricted to specific organizations or sharing groups, leading to the unauthorized disclosure of sensitive threat intelligence data. **Recommendations** Update MISP to version 2.5.48 or later.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** A missing permission check allows low-privileged users who have access to an event, but lack access to the event's orders, to extract sensitive information. The data that can be retrieved includes the total revenue and the number of attendees. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** The mechanism intended to bind API-uploaded files to the uploader's authentication method is malfunctioning. This results in the same session token being utilized for all token-based API users, effectively neutralizing the intended protection mechanism. Files uploaded via the API are referenced by randomly generated UUIDs (Universally Unique Identifiers) and are only stored for one day. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.