CVE-2026-54362: MISP template builder exposes non-visible custom galaxies across organisations
An incorrect visibility condition in the MISP event template builder allowed authenticated non-site-admin users to view galaxies that should not have been visible to their organisation. The custom access-control condition intended to restrict galaxies to those owned by the user’s organisation or distributed beyond it used a PHP comparison expression instead of a query condition. As a result, enabled galaxies, including organisation-only custom galaxies belonging to other organisations, could be exposed in the template builder galaxy list. This could disclose metadata about private galaxy definitions to unauthorised users.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Replace the custom access-control PHP comparison expression with a query-based condition that correctly restricts visible galaxies to the user's organisation or those distributed beyond it.
MISP template builder galaxy visibility condition = use a query condition that restricts galaxies to those owned by the user's organisation or distributed beyond it (do not use a PHP comparison expression) - Compensating control
Temporarily restrict access to the template builder galaxy listing to site-admins or to trusted organisation-scoped users until the visibility-condition fix is applied.
- Operational
Audit enabled custom galaxies and the template builder galaxy list for organisation-only custom galaxies that may have been exposed to other organisations; re-scope, disable, or remove any private galaxy definitions that were unintentionally disclosed.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-54362?
The severity of CVE-2026-54362 is medium with a CVSS score of 5.3.
How do I fix CVE-2026-54362?
To fix CVE-2026-54362, update to the latest version of the MISP Project MISP software that addresses this vulnerability.
What is the impact of CVE-2026-54362?
CVE-2026-54362 allows authenticated non-site-admin users to view non-visible custom galaxies that should be restricted to their organisation.
Who is affected by CVE-2026-54362?
Authenticated users who are not site administrators in organisations using the MISP Project MISP software are affected by CVE-2026-54362.
When was CVE-2026-54362 published?
CVE-2026-54362 was published on June 12, 2026.