Executive brief
MISP is an open-source platform used by organizations to share and analyze threat intelligence. A security flaw in the event template builder allowed regular users to see private 'galaxies' (threat actor libraries or classification schemes) belonging to other organizations. This could lead to the unauthorized disclosure of sensitive metadata and private intelligence definitions between different groups using the same platform.
Technical details
An authorization bypass exists in the MISP event template builder due to an incorrect visibility condition. The custom access-control logic intended to restrict galaxy visibility to a user's own organization or public distributions incorrectly used a PHP comparison expression instead of a database query condition. Specifically, the code used a comparison operator within an array definition that failed to properly filter results at the database level. An authenticated attacker with standard user privileges could exploit this to view metadata of private, organization-only custom galaxies that should otherwise be restricted. A fix has been committed to the MISP repository to correctly implement the query conditions.
Affected products
- MISP Project MISP Prior to commit 8aa2bb6d1af6e8c57c8d8437cf203acb8bce7a53
Timeline
- 2026-06-12: disclosed
- 2026-06-12: advisory