CVE-2026-10855: MISP Event Template Authorization Flaw – Patch Guidance

Technical summary

CVE-2026-10855 is a broken authorization vulnerability in MISP's Event Template Importer affecting the overwrite workflow. The root cause is a missing authorization check in the template replacement logic: the application performed an existence check on the target template but omitted verification that the requesting user belonged to the template owner's organization. The vulnerability is classified as CWE-862 (Missing Authorization) and assigned CVSS v3.1 score 4.3 (MEDIUM severity, with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N). The flaw requires network access, low complexity, authenticated user privileges, and results in integrity impact without confidentiality or availability loss. Exploitation modifies the template but does not alter other resources. The fix enforces organizational ownership validation for non-administrative accounts before permitting overwrites.

Business impact

Organizations using MISP for collaborative threat intelligence sharing face operational and data integrity risk. An attacker with legitimate access to MISP could compromise the reliability of event templates maintained by partner organizations, potentially degrading the quality of threat data workflows, alert templates, or sharing rule sets. If templates are used to automate event correlation or enrichment, malicious modifications could cause downstream analysis errors or false positives. The impact is contained to template structure and metadata rather than event data itself, and administrative oversight can detect and restore tampered templates. However, undetected modifications could silently degrade intelligence quality over time, particularly in environments with many inter-organizational template dependencies.

Affected systems

The vulnerability affects MISP (Malware Information Sharing Platform) as distributed by the MISP Project. All versions prior to the patched release are potentially impacted. Site administrators and super-users are not affected, as they have explicit cross-organizational template management permissions. Only non-administrator authenticated users with access to the template import feature can trigger the flaw. Organizations with single-organization deployments or those that restrict template import privileges to administrators only face lower exposure.

Exploitability

Exploitation requires an active MISP user account and network access to the template import interface. The attack vector is network-based, complexity is low (no special conditions or race conditions required), and authentication is mandatory. An attacker cannot exploit this anonymously or remotely without valid credentials. Once authenticated, the attacker can use the standard template import UI to overwrite any template name, regardless of organizational ownership. No user interaction or special technical skill is needed beyond knowledge of the target template identifier. The attack is deterministic and leaves audit traces in import logs, making detection feasible if logs are monitored. The relatively straightforward exploitation path is partially offset by the requirement for valid user credentials and the medium severity rating reflecting limited direct impact scope.

Remediation

Update MISP to a patched version that implements organizational ownership validation in the template overwrite workflow. The vendor fix enforces a check confirming that the importing user's organization matches the owning organization of the target template before any overwrite is permitted. Non-administrative users cannot bypass this check. Site administrators retain their cross-organizational permissions. After patching, verify that template import functionality operates normally and that cross-organization template access is restricted as intended. Organizations should review template import audit logs for the period prior to patching to identify any unauthorized overwrites, then restore affected templates from backups if needed.

Patch guidance

Consult the MISP Project security advisories and release notes for the specific patched version addressing CVE-2026-10855. The fix is expected to be included in a maintenance release following the vulnerability publication date of June 4, 2026 (modified June 22, 2026). Apply patches through the standard MISP update mechanism, which typically involves pulling the latest source from the project repository or installing via package manager if available. Test the patched version in a non-production environment to confirm that legitimate template imports and overwrites by authorized users continue to function. Verify that cross-organization overwrites are now blocked for non-administrators. Coordinate patching with dependent systems that may rely on template synchronization across MISP instances.

Detection guidance

Monitor MISP's template import audit logs for unusual patterns: overwrites of templates by users whose organization does not match the template owner, or repeated failed import attempts. Inspect the MISP database directly for templates with modification timestamps that do not correlate with known legitimate import activities. Compare template versions across time to identify unexpected structural changes, attribute additions, or metadata alterations. Set alerts on failed authorization checks if MISP exposes such events in its logging framework. For organizations with federated MISP instances, track synchronization events to detect if malicious templates propagated between instances. Review user account activity to identify accounts that accessed the template import feature outside normal operational windows or with unusual frequency.

Why prioritize this

This vulnerability merits timely but not emergency patching. The MEDIUM severity rating reflects the requirement for authenticated access and limited scope of impact (template metadata modification only, not event data or system availability). However, the flaw directly undermines trust in multi-organization threat intelligence collaboration, and undetected template manipulation could silently degrade analysis quality. Organizations that share MISP templates across organizational boundaries should prioritize patching within standard maintenance windows. Those with single-organization deployments or restricted template import privileges may defer patching slightly but should not neglect it, as insider threats or compromised user accounts could still exploit the flaw. The lack of CISA KEV status indicates no active exploitation in the wild as of the vulnerability publication date.

Risk score, explained

CVE-2026-10855 receives a CVSS v3.1 score of 4.3 (MEDIUM) based on: network-accessible attack surface, low complexity of exploitation, mandatory authentication (reducing casual abuse), and integrity impact limited to template objects without affecting confidentiality or availability. The score reflects realistic attack scenarios where organizational trust boundaries are meaningful in MISP deployments. The relatively lower score appropriately captures that template tampering, while damaging, does not directly compromise event data, system uptime, or user credentials. Organizations with high operational reliance on template integrity or those managing sensitive threat feeds may assign higher internal risk scores to reflect business context.

Frequently asked questions