MISP CVE-2026-10855

Exploitation requires: (1) an authenticated MISP account with the template import role permission enabled - this is not a default low-privilege capability; (2) knowledge of a target event template UUID belonging to a different organization on the same MISP instance, obtainable via the MISP UI or API; and (3) the import request submitted explicitly in overwrite mode. Site administrators are excluded from this restriction by design (the fix preserves their cross-org overwrite capability via the perm_site_admin check) and are therefore not affected. Exploitation is bounded by the PR:H CVSS requirement - anonymous or minimally privileged users cannot exploit this. Instances where template import permissions are broadly granted to untrusted or external-org users face materially higher realistic risk than tightly permissioned deployments.

CVSS 4.0 scores this 5.1 (Medium) with vector AV:N/AC:L/AT:N/PR:H/UI:N, reflecting network reachability and low attack complexity but a high privilege requirement (PR:H) - the attacker must already hold an authenticated account with template import capability. Confidentiality impact is zero (VC:N/SC:N); integrity impact is limited and scoped (VI:L/SI:L). SSVC corroborates a measured risk posture: exploitation is none, the attack is not automatable (requires deliberate, authenticated, per-target action), and technical impact is partial. There is no CISA KEV listing and no public exploit code has been identified at time of analysis. No EPSS score was provided in available data; given PR:H and SSVC exploitation:none, opportunistic mass exploitation is unlikely. The real-world priority is elevated specifically for shared MISP instances with multiple distrusting organizations - template corruption can silently alter the structure, attributes, or metadata used for subsequent event creation and sharing workflows, creating subtle data integrity problems that may be difficult to detect.

An authenticated MISP user with template import privileges on a shared multi-organization instance identifies the UUID of an event template owned by a target organization - obtainable through normal MISP template browsing. The attacker submits an HTTP import request in overwrite mode referencing that UUID with a crafted template payload; the pre-patch server replaces the victim organization's template without checking ownership. No public exploit code has been identified at time of analysis, but exploitation requires only standard HTTP interaction and valid session credentials.