Technical impact
A flaw in the MISP Event Template Importer allowed an authenticated user to overwrite an event template belonging to another organization without legitimate ownership verification. The vulnerability stems from neglecting to enforce that the importing user’s organization matches the template’s owner, leaving the integrity of templates exposed. This flaw enables users to alter the structure, attributes, or metadata of organizational event templates, potentially disrupting downstream event creation and sharing processes. The weakness is classified as an authorization bypass (CWE-862).
Affected Systems
The issue affects installations of MISP where the Event Template Importer is enabled. Any deployment of MISP that has not incorporated the commit that enforces ownership checking (commit 7c2200d143bef86aaf58d701b6968a843097db69) is susceptible. Site administrators remain unaffected because they are intentionally permitted cross‑organization overwrites.
Risk and Exploitability
The CVSS score of 5.1 indicates a medium severity. An attacker must be an authenticated user with template import rights to exploit the flaw, which limits the attack surface to authorized personnel within an organization. Since the EPSS score is unavailable, the likelihood of exploitation is uncertain, but the absence from the CISA KEV catalog suggests no confirmed widespread exploitation yet. Still, the vulnerability permits unauthorized alteration of cross‑organization templates, which can compromise the integrity of shared threat intelligence flows.
