MISP's event template handling allows an authenticated user to supply a pre‑encoded string for the definition field. The system only performs semantic validation when the definition is already an array; a string bypasses this check and only satisfies a generic not‑blank rule. Consequently, malformed JSON or data of an unexpected type can be stored in the database, leading to server‑side errors when templates are retrieved. The weakness is a classical input validation flaw (CWE‑20). The impact is that a single malicious or misconstructed template can cause all event‑template queries to fail with HTTP 500 errors until the offending database row is repaired, providing a persistent denial of service for users relying on templating.

The affected product is MISP, specifically the event‑template component in the MISP platform. No specific version range is listed, so any deployment suitable for creating or modifying event templates is impacted.

The CVSS score of 7.1 indicates a medium to high severity. EPSS is not available, and the flaw is not currently listed in the CISA KEV catalog. Exploitation requires an authenticated user with the right to create or modify event templates, a privilege commonly granted to analysts or administrators. Once leveraged, the attacker can persist malformed template data, causing repeated server errors for all users accessing the template index. The lack of defensive checks during retrieval means the exception is thrown before normal response handling, directly resulting in denial of service until the database entry is manually fixed.