CVE-2026-10854: Unauthorized exposure of private galaxies in MISP event template creation
A visibility control issue in the event template creation workflow allowed non-site-admin users to access private galaxies belonging to other organisations. The event template builder loaded all enabled galaxies without applying organisation or distribution-based access restrictions, potentially exposing private galaxy metadata such as galaxy type and description to users who should not have visibility.
The issue has been fixed by restricting galaxy queries for non-site-admin users to galaxies owned by the user’s organisation or galaxies with a non-private distribution setting. Site administrators retain visibility of all enabled galaxies.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update/enable the fix so that, during event template creation, the event template builder restricts galaxy queries for non-site-admin users to only galaxies owned by the user’s organisation or galaxies configured with a non-private distribution, instead of loading all enabled galaxies.
MISP event template creation workflow galaxy query restrictions for non-site-admin users = Restrict to galaxies owned by the user’s organisation or to galaxies with a non-private distribution setting
Event History
Frequently Asked Questions
What is the severity of CVE-2026-10854?
The severity of CVE-2026-10854 is medium with a CVSS score of 5.3.
How do I fix CVE-2026-10854?
To fix CVE-2026-10854, apply the available patch from the MISP project.
What type of vulnerability is CVE-2026-10854?
CVE-2026-10854 is classified as an information leak vulnerability.
What impact does CVE-2026-10854 have on users?
CVE-2026-10854 allows non-site-admin users to access private galaxies from other organizations, leading to unauthorized exposure.
When was CVE-2026-10854 published?
CVE-2026-10854 was published on June 4, 2026.