CVE-2026-54362

Name of the Vulnerable Software and Affected Versions MISP (affected versions not specified)

Description An incorrect visibility condition in the event template builder allows authenticated non-site-admin users to view galaxies that should not be visible to their organization. The issue stems from a custom access-control condition that uses a PHP comparison expression instead of a query condition to restrict galaxies to those owned by the user's organization or distributed beyond it. Consequently, enabled galaxies, including organization-only custom galaxies belonging to other organizations, may be exposed in the template builder galaxy list, potentially disclosing metadata about private galaxy definitions to unauthorized users.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.