Is there a patch available for CVE-2026-10854?

Yes, a patch is available for CVE-2026-10854. Update the affected software to the latest version immediately.

MISP CVE-2026-10854

Q: What is the CVSS score of CVE-2026-10854?

CVE-2026-10854 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Green. EPSS exploitation probability: 0.0%.

EUVD-2026-34257 MEDIUM

Information Exposure (CWE-200)

2026-06-04 CIRCL

GHSA-3636-3mqq-q7x9

Information Disclosure Misp

5.3

CVSS 4.0 · Vendor: CIRCL

Severity by source

Vendor (CIRCL) PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Green

Primary rating from Vendor (CIRCL) · only source for this CVE.

CVSS VectorVendor: CIRCL

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jun 04, 2026 - 16:25 vuln.today

Analysis Generated

Jun 04, 2026 - 16:25 vuln.today

CVSS changed

Jun 04, 2026 - 14:22 NVD

5.3 (MEDIUM)

CVE Published

Jun 04, 2026 - 12:51 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

A visibility control issue in the event template creation workflow allowed non-site-admin users to access private galaxies belonging to other organisations. The event template builder loaded all enabled galaxies without applying organisation or distribution-based access restrictions, potentially exposing private galaxy metadata such as galaxy type and description to users who should not have visibility.

The issue has been fixed by restricting galaxy queries for non-site-admin users to galaxies owned by the user’s organisation or galaxies with a non-private distribution setting. Site administrators retain visibility of all enabled galaxies.

AnalysisAI

Private galaxy metadata in MISP versions up to and including 2.5.38 was exposed to authenticated non-site-admin users through the event template builder workflow due to missing organisation and distribution-based access controls. The EventTemplatesController.php __setBuilderConfig() method queried all enabled galaxies without filtering by ownership or distribution level, allowing users from one organisation to read galaxy names, types, and descriptions that belong to other organisations and are marked private. No public exploit has been identified and SSVC rates exploitation as none; however, in multi-tenant intelligence-sharing environments this information disclosure carries meaningful operational security risk, as galaxy metadata can reveal the intelligence focus areas or classification schemes of peer organisations.

Technical ContextAI

MISP (Malware Information Sharing Platform) uses a 'galaxy' abstraction to organise threat intelligence using structured taxonomies and clusters. Each galaxy carries an organisation owner (org_id) and a distribution flag controlling visibility across organisations. The vulnerability resides in EventTemplatesController.php within the private __setBuilderConfig() method, which constructs the configuration for the event template builder UI. Prior to the fix, the galaxy query condition was limited to 'Galaxy.enabled = true', entirely omitting the org_id and distribution filters that govern galaxy visibility elsewhere in the application. CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) precisely describes this root cause: a discrete code path bypassed the access control model applied globally. The upstream fix introduces an $orgCondition block that, for non-site-admin users, restricts results to galaxies where Galaxy.org_id matches the authenticated user's organisation OR Galaxy.distribution is greater than 0 (non-private). CPE cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:* confirms the vulnerability spans the full MISP application product.

RemediationAI

The primary fix is available as upstream commit d3adfe1a097dd4b403364e9af34e208660eeec1a at https://github.com/MISP/MISP/commit/d3adfe1a097dd4b403364e9af34e208660eeec1a, which modifies EventTemplatesController.php to enforce organisation and distribution-based access controls in the galaxy query used by the template builder. Organisations running MISP ≤ 2.5.38 should upgrade to the first tagged release incorporating this commit once published, or apply the patch directly to the affected controller file. A specific patched release version number is not confirmed from available data - monitor the MISP GitHub releases page for the version that includes this commit. As a compensating control pending upgrade, site administrators can restrict event template creation access to a reduced set of trusted users via MISP's role-based access control, thereby limiting exposure to the minimum necessary user population. This control does not eliminate the vulnerability but reduces the pool of users who can trigger the affected code path. There is no indication that disabling any specific MISP module or feature (short of the template builder itself) would fully mitigate the issue.