CVE-2026-54362: MISP Information Disclosure Vulnerability

CVE-2026-54362 Overview

CVE-2026-54362 is an authorization flaw in the Malware Information Sharing Platform (MISP) event template builder. The vulnerability stems from an incorrect visibility condition that allowed authenticated non-site-admin users to view galaxies belonging to other organisations. The custom access-control logic used a PHP comparison expression instead of a proper database query condition. As a result, enabled galaxies — including organisation-only custom galaxies belonging to other organisations — were exposed in the template builder galaxy list. This disclosed metadata about private galaxy definitions to unauthorised users. The issue is classified under [CWE-863] Incorrect Authorization.

Critical Impact
Authenticated MISP users could enumerate metadata of private, organisation-only galaxies belonging to other tenants through the event template builder.

Affected Products

MISP (Malware Information Sharing Platform)
app/Controller/EventTemplatesController.php component
Instances with multi-organisation deployments and custom organisation-only galaxies

Discovery Timeline

2026-06-12 - CVE-2026-54362 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-54362

Vulnerability Analysis

The flaw resides in the EventTemplatesController of MISP, specifically in the logic that retrieves galaxies for the event template builder. Galaxies in MISP represent structured threat intelligence taxonomies and can be marked as private to a single organisation via a distribution value of 0. The controller attempted to enforce per-organisation visibility through an inline conditional array. However, the conditional was syntactically malformed and never reached the database query engine in a meaningful way. Every enabled galaxy was returned to any authenticated user accessing the template builder, regardless of distribution or ownership.

Root Cause

The broken expression 'Galaxy.distribution' > 0 is a PHP string-to-integer comparison rather than a CakePHP query condition. The string 'Galaxy.distribution' is cast to 0 during comparison, producing 0 > 0, which always evaluates to false. The wrapping OR array containing this expression was therefore syntactically valid but semantically degenerate when passed to the ORM. The result was that the $orgCondition array failed to constrain the find('all', ...) query, allowing every enabled galaxy row to be returned irrespective of org_id or distribution.

Attack Vector

An authenticated user with standard organisation-level privileges navigates to the event template builder interface. The backend issues a Galaxy.find('all') query filtered only by Galaxy.enabled = true. The response includes galaxies owned by other organisations with distribution = 0. The attacker harvests galaxy type, name, and related metadata to map private intelligence taxonomies maintained by peer organisations.

php

// Vulnerable pattern (removed) and corrected fix from the official patch
            );
        }
        $this->set('taxonomiesAvailable', $taxonomies);
-        $orgCondition = $this->_isSiteAdmin()
-            ? array()
-            : array(
-                'OR' => array(
-                    'Galaxy.org_id' => (int)$this->Auth->user('org_id'),
-                    'Galaxy.distribution' > 0,
-                ),
-            );
-
        $this->loadModel('Galaxy');
        $galaxyRows = $this->Galaxy->find('all', array(
            'recursive' => -1,
            'conditions' => array(
                'Galaxy.enabled' => true,
-                $orgCondition,
+                // Use the canonical galaxy visibility filter. The previous hand-rolled condition
+                // `'Galaxy.distribution' > 0` was a PHP comparison (always evaluating to true), not a
+                // query condition, so every org's galaxies - including org-only (distribution 0) custom
+                // galaxies belonging to other orgs - leaked into the template builder list.
+                $this->Galaxy->buildConditions($this->Auth->user()),
            ),
            'fields' => array(
                'Galaxy.type',

Source: MISP commit 8aa2bb6d1af6e8c57c8d8437cf203acb8bce7a53

Detection Methods for CVE-2026-54362

Indicators of Compromise

Web server access logs showing repeated requests to event template builder endpoints from non-site-admin accounts.
Application logs indicating galaxy enumeration patterns from a single user session across short time windows.
Unexpected references in user activity to galaxy names or types not associated with the user's organisation.

Detection Strategies

Review MISP audit logs for accesses to the event template builder by users belonging to organisations that do not own custom galaxies.
Compare returned galaxy lists in the template builder against the user's org_id and the Galaxy.distribution field to identify anomalous exposure.
Hunt for HTTP responses from /event_templates/* containing galaxy metadata inconsistent with the requester's organisation scope.

Monitoring Recommendations

Enable verbose application logging on the EventTemplatesController and forward logs to a centralized analytics platform for correlation.
Monitor for accounts performing template builder requests at a frequency inconsistent with normal user behaviour.
Alert on database query patterns selecting from the galaxies table without organisation-scoped conditions.

How to Mitigate CVE-2026-54362

Immediate Actions Required

Apply the upstream MISP patch from commit 8aa2bb6d1af6e8c57c8d8437cf203acb8bce7a53 to all MISP instances.
Audit existing organisation-only custom galaxies to determine whether their metadata may have already been exposed to other organisations.
Restrict template builder access to trusted user roles until the patch is deployed.

Patch Information

The upstream fix replaces the malformed inline $orgCondition with a call to $this->Galaxy->buildConditions($this->Auth->user()), which is the canonical galaxy visibility filter used elsewhere in MISP. The patch is available in the official MISP GitHub commit. Administrators should pull the latest MISP release and redeploy the app/Controller/EventTemplatesController.php file.

Workarounds

Temporarily disable the event template builder feature for non-site-admin users via role-based access control.
Convert sensitive organisation-only galaxies to be locally maintained outside of MISP until the patch is applied.
Limit MISP instance access to vetted authenticated users through network segmentation and identity controls.

bash

# Apply the upstream patch
cd /var/www/MISP
sudo -u www-data git fetch origin
sudo -u www-data git cherry-pick 8aa2bb6d1af6e8c57c8d8437cf203acb8bce7a53
sudo systemctl restart apache2