Is there a patch available for CVE-2026-54362?

Yes, a patch is available for CVE-2026-54362. Update the affected software to the latest version immediately.

MISP CVE-2026-54362

Q: What is the CVSS score of CVE-2026-54362?

CVE-2026-54362 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-36580 MEDIUM

Incorrect Authorization (CWE-863)

2026-06-12 CIRCL

GHSA-cjp7-pm9q-xhqg

Authentication Bypass PHP Misp

5.3

CVSS 4.0 · Vendor: CIRCL

Severity by source

Vendor (CIRCL) PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.0 MEDIUM

Network access by any authenticated user (PR:L); scope change (S:C) because other organisations' private data is exposed; confidentiality limited to metadata (C:L); no integrity or availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N

Primary rating from Vendor (CIRCL).

CVSS VectorVendor: CIRCL

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jun 12, 2026 - 21:27 vuln.today

Analysis Generated

Jun 12, 2026 - 21:27 vuln.today

DescriptionCVE.org

An incorrect visibility condition in the MISP event template builder allowed authenticated non-site-admin users to view galaxies that should not have been visible to their organisation. The custom access-control condition intended to restrict galaxies to those owned by the user’s organisation or distributed beyond it used a PHP comparison expression instead of a query condition. As a result, enabled galaxies, including organisation-only custom galaxies belonging to other organisations, could be exposed in the template builder galaxy list. This could disclose metadata about private galaxy definitions to unauthorised users.

AnalysisAI

Incorrect authorization in MISP's event template builder exposes organisation-private galaxy definitions to any authenticated user due to a PHP operator-precedence bug that silently voids the intended access-control filter. In multi-tenant MISP deployments, authenticated non-site-admin users can enumerate all enabled galaxies - including organisation-only custom galaxies belonging to other organisations - through the template builder galaxy list. No active exploitation is confirmed (not listed in CISA KEV), but the low exploitation barrier (any valid account, no special privileges) makes this a meaningful metadata-disclosure risk wherever multiple organisations share a MISP instance.

Technical ContextAI

MISP is an open-source threat intelligence sharing platform developed and maintained by CIRCL. The vulnerability resides in app/Controller/EventTemplatesController.php within the __setBuilderConfig() private method. The CakePHP ORM expects access-control conditions as key-value arrays where keys are column expressions and values are the comparison targets; however, the expression 'Galaxy.distribution' > 0 is a PHP comparison operator invocation, not an ORM condition pair. PHP evaluates this at parse time and reduces it to the integer 1 (true), which is then passed as a standalone truthy element inside an OR array, causing the ORM to treat it as an always-matching condition. This means every enabled galaxy - regardless of distribution scope - passes the filter. The root cause is CWE-863 (Incorrect Authorization), specifically a logic error where a language-level expression was mistaken for a query-layer condition. The fix replaces the broken hand-rolled filter with $this->Galaxy->buildConditions($this->Auth->user()), the canonical MISP galaxy visibility method that correctly enforces org_id ownership and distribution level checks at the database query layer.

RemediationAI

Apply upstream commit 8aa2bb6d1af6e8c57c8d8437cf203acb8bce7a53 from https://github.com/MISP/MISP/commit/8aa2bb6d1af6e8c57c8d8437cf203acb8bce7a53, which replaces the broken inline OR condition in __setBuilderConfig() with the canonical $this->Galaxy->buildConditions($this->Auth->user()) call that correctly applies distribution and org_id scoping at the database level. Operators running MISP from the develop or main branch should pull and redeploy immediately. A tagged release incorporating this fix is not independently confirmed from available data - monitor the MISP GitHub releases page (https://github.com/MISP/MISP/releases) for the next version containing this commit. As a compensating control for deployments that cannot patch immediately, restricting MISP access to a single trusted organisation eliminates cross-org disclosure entirely, but this trade-off removes multi-tenancy capability. There is no documented in-application configuration toggle that disables the template builder's galaxy list without disabling template builder functionality.