An incorrect visibility condition in the MISP event template builder allows authenticated non‑site‑admin users to view private galaxy definitions that should be restricted to their own organization. This results in unauthorized disclosure of metadata about custom galaxies belonging to other organizations. The flaw is rooted in improper authorization (CWE‑863), where a PHP comparison expression was used instead of a query condition to restrict visibility.

Any installation of the MISP platform that includes the event template builder feature is affected, regardless of version, because the vulnerability stems from the code base rather than a specific release. The issue exists for the community edition and any fork that has not applied the corrective commit referenced in the advisory.

With a CVSS score of 5.3, the risk is moderate; the EPSS score is currently not available, and the vulnerability is not listed in CISA KEV. The typical attack vector involves an authenticated user with non‑site‑admin permissions navigating the web interface to the template builder. Once the interface lists galaxies, the attacker can see galaxies owned by other organizations and gain insight into their content, which may lead to further exploitation if additional weaknesses are present elsewhere.