update_object() does not work with custom objects

Version:
Latest (2.4.148 for both MISP and PyMISP) - I just updated and confirmed it was still a bug right before opening this issue.

Expected behavior:

• Create a custom object and save to a MISP event
• At a later point in time, fetch that object and add an attribute to it
• Update that object using the PyMISP.update_object() method
• Custom object is updated in MISP with the newly added attribute
• Go about your merry way

Actual behavior:

• Create a custom object and save to a MISP event
• Fetch that object and add an attribute to it
• Update that object using the PyMISP.update_object() method
• Something went wrong (403): {'saved': False, 'name': 'Could not edit Object', 'message': 'Could not edit Object', 'url': '/objects/edit', 'errors': 'xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxx'}
• Spend half a day wondering what you did wrong

Reproduction code:

from pymisp import PyMISP, MISPObject

misp = PyMISP('https://<your_url>/', '<your_api_key>')

# Get existing event and add newly created custom object (no template exists)

demo_event = misp.get_event('1234', pythonify=True)
cust_obj = MISPObject('custom-object')
cust_obj.add_attribute('custom-attribute', value='testing1', type='text', to_ids=False)
updated_object = demo_event.add_object(cust_obj, pythonify=True)
cust_obj_uuid = updated_object.uuid

updated_event = misp.update_event(demo_event, pythonify=True)

# So far so good...

# try updating newly created object

cust_obj = misp.get_object(cust_obj_uuid, pythonify=True)
cust_obj.add_attribute('another-custom-attribute', value='testing2', type='text', to_ids=False)

# ...still okay...

latest_obj = misp.update_object(cust_obj)

# Something went wrong (403): {'saved': False, 'name': 'Could not edit Object', 'message': 'Could not edit Object', 'url': '/objects/edit', 'errors': 'xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxx'}

I hope that captures the problem efficiently.

The only instance in which I could get update_object() to work properly was when I was interacting with an object that was already a default MISP template.

Are we no longer allowed to update MISP objects without first uploading a corresponding template? Or am I missing something obvious?

Thanks in advance for your help!

Start at the PyMISP.update_object() entry point and reproduce the failure with the custom-object example in this issue. Compare the working default-template case with the failing custom-object case, then verify that adding the second attribute succeeds without the 403 response.