Is there a patch available for CVE-2026-10855?

Yes, a patch is available for CVE-2026-10855. Update the affected software to the latest version immediately.

MISP CVE-2026-10855

Q: What is the CVSS score of CVE-2026-10855?

CVE-2026-10855 has a CVSS 4.0 base score of 5.1 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-34259 MEDIUM

Missing Authorization (CWE-862)

2026-06-04 CIRCL

GHSA-243v-5f97-vfq3

Authentication Bypass Misp

5.1

CVSS 4.0 · Vendor: CIRCL

Severity by source

Vendor (CIRCL) PRIMARY

5.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (CIRCL) · only source for this CVE.

CVSS VectorVendor: CIRCL

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jun 04, 2026 - 16:24 vuln.today

Analysis Generated

Jun 04, 2026 - 16:24 vuln.today

CVSS changed

Jun 04, 2026 - 14:22 NVD

5.1 (MEDIUM)

CVE Published

Jun 04, 2026 - 13:05 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

An authorization flaw existed in the MISP Event Template Importer overwrite workflow. When importing an event template in overwrite mode, the application checked whether a matching template already existed but did not verify that the importing user belonged to the organization that owned the existing template. As a result, an authenticated user with access to the template import functionality could forcibly overwrite an event template owned by another organization.

Successful exploitation could allow unauthorized modification of another organization’s event template, potentially altering template structure, attributes, or metadata used for subsequent event creation or sharing workflows. Site administrators are not affected by this restriction, as they are explicitly allowed to overwrite templates across organizations.

The issue was fixed by enforcing an ownership check before overwrite: non-site-admin users may only overwrite templates owned by their own organization.

AnalysisAI

Authorization bypass in MISP's Event Template Importer allows authenticated users with template import privileges to overwrite event templates owned by other organizations on the same shared instance, violating inter-organizational data ownership boundaries. Versions up to and including 2.5.38 are affected; the overwrite workflow confirmed template existence but omitted an organizational ownership check, enabling cross-org template corruption. No public exploit code has been identified at time of analysis and SSVC signals no active exploitation, but the integrity impact is operationally significant in multi-tenant MISP deployments where organizational trust boundaries are critical.

Technical ContextAI

MISP (Malware Information Sharing Platform) is an open-source threat intelligence sharing platform where multiple organizations co-exist in a single instance and own discrete data objects - including event templates - enforced via an org_id field. The vulnerable code resides in app/Lib/Tools/EventTemplateImporter.php within the import() method's overwrite branch. The root cause maps to CWE-862 (Missing Authorization): the pre-patch logic confirmed whether a matching template UUID existed before overwriting, but never compared the requesting user's org_id against the existing template's org_id. The fix, visible in commit 7c2200d143bef86aaf58d701b6968a843097db69, inserts a single conditional guard - if ($user['org_id'] !== (int)$existing['EventTemplate']['org_id'] && !$user['Role']['perm_site_admin']) - that raises MethodNotAllowedException for unauthorized cross-org overwrites. The affected CPE is cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:* covering all versions through 2.5.38 per ENISA EUVD-2026-34259.

RemediationAI

The upstream fix is available via commit 7c2200d143bef86aaf58d701b6968a843097db69 at https://github.com/MISP/MISP/commit/7c2200d143bef86aaf58d701b6968a843097db69; operators should upgrade MISP to the first tagged release incorporating this commit (the release immediately following 2.5.38 - confirm the exact version tag in the MISP GitHub releases list, as the precise patched release version was not confirmed in available data). As a compensating control for deployments that cannot patch immediately, administrators should audit and restrict the template import permission to only fully trusted, organization-verified users, reducing the pool of accounts capable of invoking the overwrite workflow. Note that restricting template import access may impact legitimate bulk import or synchronization workflows and should be coordinated with instance administrators before applying. No other workarounds exist, as the flaw is embedded in core import logic.