A visibility control flaw in MISP’s event template creation workflow allowed non‑site‑admin users to load all enabled galaxies without applying organization or distribution checks. As a result, those users could view private galaxy metadata such as type and description from other organizations, constituting a confidentiality breach that maps to CWE‑200 and is reflected in the CVSS score of 5.3.

The issue affects installations of the MISP platform (Malware Information Sharing Platform) that include the event template creation feature. Any version of MISP that has not yet incorporated the change in commit d3adfe1a, which added organization‑based filtering for non‑admin users, is vulnerable.

The CVSS score of 5.3 indicates a moderate severity risk. Although EPSS is not available, the fact that private galaxy metadata can be exposed makes the vulnerability useful for attackers seeking internal knowledge. The vulnerability is accessed through the web UI during event template creation; non‑site‑admin users can inadvertently trigger it by generating a new template. The vulnerability is not listed in the CISA KEV catalog, and no specific exploit code is publicly known. Nevertheless, the lack of proper access restrictions provides a clear avenue for information disclosure.