CVE-2026-86418

MISP Dashboard Organisation Picker Exposes Hidden Organisation Metadata to Unauthorized Users

View on CVE.org
Published Sep 7, 2026 CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed
Description
Affected versions of MISP expose organisation metadata through the dashboard organisation picker without applying the same visibility restrictions enforced by the normal organisation index and per-organisation view.

The affected endpoint returned fields including:

 - organisation ID;

 - UUID;

 - name.






When Security.hide_organisation_index_from_users was enabled, normal organisation enumeration was restricted, but the dashboard picker still queried all organisations. This allowed authenticated users to discover organisations that should have remained hidden from them.


The fix calls Organisation::createConditions($this->Auth->user()) and appends the resulting ACL conditions to the picker query. Ordinary users are thereby limited to organisations associated with events or proposals they can already see, plus their own organisation, while users with the appropriate sharing-group privilege retain broader visibility.




Version affected: ≤2.5.45

Analysis

AI-generated

Technical impact

The vulnerability in MISP affects versions up to 2.5.45. The dashboard organisation picker incorrectly returns organisation metadata – ID, UUID, and name – for all organisations regardless of visibility restrictions that normally apply to the organisation index and per‑organisation view. When Security.hide_organisation_index_from_users is enabled, standard enumeration is restricted, yet the picker still queries every organisation that should remain hidden. The implemented fix applies ACL conditions from Organisation::createConditions for the logged‑in user, limiting ordinary users to organisations they can already see or their own, while users with a sharing‑group privilege retain broader visibility.

Affected Systems

MISP MISP, all releases up to and including version 2.5.45. Administrators should check the exact MISP version; any version ≤ 2.5.45 is vulnerable and requires remediation.

Risk and Exploitability

The CVSS score of 2.3 indicates low severity, and the EPSS score is < 1%. The vulnerability is not listed in the CISA KEV catalog, suggesting no evidence of widespread exploitation. The flaw requires authenticated access but can be triggered via the web interface. Once the public patch is applied, the ACL conditions are appended to the picker query, restricting visibility to organisations a user can already see. Consequently, the risk is limited to information disclosure to authorised users and does not allow remote code execution or privilege escalation.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update MISP to a fixed version (≥ 2.5.46) or apply the security patch from the commit 8ca4486af to enforce ACL conditions on the organisation picker.
  • Ensure that the Security.hide_organisation_index_from_users configuration setting is enabled and that no custom code bypasses the ACL conditions added by Organisation::createConditions for the picker query.
  • Implement monitoring of the dashboard organization picker API to detect and alert on attempts to enumerate hidden organizations by authenticated users.

Generated by OpenCVE AI on September 21, 2026 at 05:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Description Affected versions of MISP expose organisation metadata through the dashboard organisation picker without applying the same visibility restrictions enforced by the normal organisation index and per-organisation view. The affected endpoint returned fields including: * organisation ID; * UUID; * name. When Security.hide_organisation_index_from_users was enabled, normal organisation enumeration was restricted, but the dashboard picker still queried all organisations. This allowed authenticated users to discover organisations that should have remained hidden from them. The fix calls Organisation::createConditions($this->Auth->user()) and appends the resulting ACL conditions to the picker query. Ordinary users are thereby limited to organisations associated with events or proposals they can already see, plus their own organisation, while users with the appropriate sharing-group privilege retain broader visibility. Version affected: ≤2.5.45 Affected versions of MISP expose organisation metadata through the dashboard organisation picker without applying the same visibility restrictions enforced by the normal organisation index and per-organisation view. The affected endpoint returned fields including:  - organisation ID;  - UUID;  - name. When Security.hide_organisation_index_from_users was enabled, normal organisation enumeration was restricted, but the dashboard picker still queried all organisations. This allowed authenticated users to discover organisations that should have remained hidden from them. The fix calls Organisation::createConditions($this->Auth->user()) and appends the resulting ACL conditions to the picker query. Ordinary users are thereby limited to organisations associated with events or proposals they can already see, plus their own organisation, while users with the appropriate sharing-group privilege retain broader visibility. Version affected: ≤2.5.45
Type Values Removed Values Added
First Time appeared Misp-project
Misp-project misp
CPEs cpe:2.3:a:misp-project:misp:*:*:*:*:*:*:*:*
Vendors & Products Misp-project
Misp-project misp
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'}
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Misp
Misp misp
Vendors & Products Misp
Misp misp
Type Values Removed Values Added
Description Affected versions of MISP expose organisation metadata through the dashboard organisation picker without applying the same visibility restrictions enforced by the normal organisation index and per-organisation view. The affected endpoint returned fields including: * organisation ID; * UUID; * name. When Security.hide_organisation_index_from_users was enabled, normal organisation enumeration was restricted, but the dashboard picker still queried all organisations. This allowed authenticated users to discover organisations that should have remained hidden from them. The fix calls Organisation::createConditions($this->Auth->user()) and appends the resulting ACL conditions to the picker query. Ordinary users are thereby limited to organisations associated with events or proposals they can already see, plus their own organisation, while users with the appropriate sharing-group privilege retain broader visibility. Version affected: ≤2.5.45
Title MISP Dashboard Organisation Picker Exposes Hidden Organisation Metadata to Unauthorized Users
Weaknesses CWE-200
CWE-862
References
Metrics cvssV4_0

{'score': 2.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N'}
Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor

  • CWE-862

    Missing Authorization

Sources

Status
PUBLISHED
Assigner
CIRCL
Published
Updated
Sep 14, 2026, 6:36 AM
Reserved
Sep 7, 2026, 12:22 PM

View source JSON

Updated
Sep 8, 2026, 2:50 PM

JSON

Status
Modified
Published
Sep 7, 2026, 1:20 PM
Modified
Sep 14, 2026, 7:17 AM

View source JSON

No data.

Updated
Sep 21, 2026, 5:30 AM

JSON