Executive brief
MISP is a threat intelligence sharing platform used by organizations to collaborate on security information. A flaw in event template handling allows authenticated users with template creation permissions to inject malformed data that causes the template system to crash with HTTP 500 errors, disrupting access to event templates for all other users until manual database repair.
Technical details
The vulnerability exists in MISP's EventTemplate::beforeValidate() method, which only validates the definition field when provided as an array, not when pre-encoded as a JSON string. An attacker with template creation privileges can supply invalid or malformed JSON that bypasses semantic validation and persists in the database. When templates are retrieved, EventTemplate::afterFind() calls JsonTool::decode() without error handling, causing unhandled exceptions when decoding fails. This results in persistent denial of service against event template queries, making the template index and related functionality unavailable (HTTP 500 errors) for all authenticated users. The patch enforces structured object validation and adds error handling to catch and safely replace malformed definitions on retrieval.
Affected products
- MISP Project MISP <UNKNOWN>
Timeline
- 2026-09-03: disclosed