CVE-2026-10854: MISP Galaxy Visibility Control Bypass – Unauthorized Private Metadata Access

Technical summary

The event template builder in MISP failed to enforce access controls when populating available galaxies. The underlying query returned all enabled galaxies regardless of the requesting user's organizational context or the galaxies' distribution settings. Non-site-admin users could enumerate and view metadata from private galaxies belonging to other organizations, violating the intended multi-tenant isolation model. The fix implements role-based filtering: non-admin users now see only galaxies their organization owns or galaxies with public (non-private) distribution settings. Site administrators retain full visibility. The vulnerability is categorized under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor).

Business impact

For MISP operators managing multi-tenant or multi-organization deployments, this vulnerability risks information leakage about threat intelligence assets. Private galaxies may contain custom threat models, organizational taxonomy, or sensitive classification schemes—exposing these to rival teams or external organizations could compromise competitive advantage or reveal defensive posture. The impact is limited to information disclosure with no integrity risk, but in threat-sharing communities or security consortia, metadata visibility can itself inform strategic decisions. Organizations with strict data compartmentalization policies should treat this as a control failure requiring prompt remediation.

Affected systems

MISP (Malware Information Sharing Platform) instances running versions before the patch are affected. The vulnerability applies to any MISP deployment where non-admin users have event template creation privileges and where private galaxies exist across multiple organizations. Site administrators are not affected by the access control bypass. Standalone MISP instances with a single organization may see reduced exposure but should still patch to maintain security posture.

Exploitability

Exploitation requires valid MISP authentication; the vulnerability cannot be triggered by anonymous users. An authenticated attacker must navigate to the event template creation workflow and examine the galaxy dropdown or API responses to enumerate private galaxies. No special privileges, social engineering, or additional tooling are needed beyond MISP access. The attack surface is limited to users with template creation rights, but in many deployments this includes analysts and automation accounts. The CVSS score of 4.3 (Medium) reflects the low attack complexity and the limited scope of information exposed, offset by the authentication requirement.

Remediation

Apply the patch released by MISP that restricts galaxy visibility queries for non-admin users to owned and public galaxies. This involves updating the event template builder's galaxy enumeration logic to filter based on organization membership and distribution settings. Site administrators should validate that their private galaxies remain hidden from cross-organization users after patching and confirm that site admins retain full visibility for auditing and management purposes. No configuration changes are typically required post-patch.

Patch guidance

Consult the official MISP security advisory and release notes published on or after 2026-06-04 (publication date) through 2026-06-22 (modification date) for the specific patched version number and deployment instructions. Most MISP installations use standard package managers or Docker containers; apply the update using your standard deployment pipeline. After patching, restart the MISP application and verify that event template workflows correctly filter galaxies for non-admin users.

Detection guidance

Review MISP audit logs for event template creation activity by non-admin users during the window before patching. Search for API calls to galaxy enumeration endpoints (typically `/api/galaxies`) made by users outside the site-admin group; compare returned galaxy lists against expected organization-owned or public galaxies to identify potential information access anomalies. Monitor event template builder access patterns for systematic enumeration behavior. In MISP 2.4.x+, enable verbose logging on the template builder to capture gallery queries and filter conditions.

Why prioritize this

Although rated CVSS Medium (4.3), this vulnerability should receive prompt attention in any multi-organizational MISP deployment because it violates core access control assumptions. Threat intelligence sharing is built on trust and data compartmentalization; information leakage—even metadata—undermines that model. If your MISP instance hosts galaxies for competing organizations, research teams, or sensitive threat communities, prioritize patching within your standard maintenance window. For single-organization deployments, it remains a security fix but is lower urgency.

Risk score, explained

The CVSS 3.1 score of 4.3 places this in Medium severity. The score reflects: (1) network attack vector (readily exploitable via web interface), (2) low complexity (no special conditions or timing required), (3) authentication required (limits casual exploitation), (4) low impact on confidentiality (metadata exposure only, not bulk data theft), and (5) no impact on integrity or availability. The score appropriately captures a bounded information disclosure risk in a multi-tenant context.

Frequently asked questions