Description
Affected versions of MISP expose organisation metadata through the dashboard organisation picker without applying the same visibility restrictions enforced by the normal organisation index and per-organisation view.


The affected endpoint returned fields including:



*
organisation ID;


*
UUID;


*
name.





When Security.hide_organisation_index_from_users was enabled, normal organisation enumeration was restricted, but the dashboard picker still queried all organisations. This allowed authenticated users to discover organisations that should have remained hidden from them.


The fix calls Organisation::createConditions($this->Auth->user()) and appends the resulting ACL conditions to the picker query. Ordinary users are thereby limited to organisations associated with events or proposals they can already see, plus their own organisation, while users with the appropriate sharing-group privilege retain broader visibility.




Version affected: ≤2.5.45
Published: 2026-09-07
Score: 2.3 Low
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability in the MISP dashboard’s organisation picker allows authenticated users to see hidden organisation metadata—including IDs, UUIDs, and names—that should otherwise remain hidden when the Security.hide_organisation_index_from_users setting is enabled. Because the picker does not apply the same visibility restrictions used for the normal organisation index, users can discover organisations they should not be able to access, exposing sensitive organisational relationships and potentially facilitating social engineering or targeted attacks.

Affected Systems

MISP MISP, all releases up to and including version 2.5.45. Administrators should check the exact MISP version; any version ≤2.5.45 is vulnerable and requires remediation.

Risk and Exploitability

The CVSS score of 2.3 indicates low severity, and the EPSS score is not available, while the vulnerability is not listed in the CISA KEV catalog, suggesting no evidence of widespread exploitation. The flaw requires authenticated access but can be triggered via the web interface. Once the public patch is applied, the ACL conditions are appended to the picker query, restricting visibility to organisations a user can already see. Consequently, the risk is limited to information disclosure to authorized users and does not allow remote code execution or privilege escalation.

Generated by OpenCVE AI on September 7, 2026 at 14:16 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade MISP to version 2.5.46 or newer, which includes the ACL fix for the organisation picker.
  • After upgrading, test the picker as a non‑privileged user to confirm that hidden organisations are no longer listed.
  • Review user roles and organisation visibility configurations to ensure that only necessary users have access to organisational data, and adjust sharing‑group permissions accordingly.

Generated by OpenCVE AI on September 7, 2026 at 14:16 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 07 Sep 2026 12:30:00 +0000

Type Values Removed Values Added
Description Affected versions of MISP expose organisation metadata through the dashboard organisation picker without applying the same visibility restrictions enforced by the normal organisation index and per-organisation view. The affected endpoint returned fields including: * organisation ID; * UUID; * name. When Security.hide_organisation_index_from_users was enabled, normal organisation enumeration was restricted, but the dashboard picker still queried all organisations. This allowed authenticated users to discover organisations that should have remained hidden from them. The fix calls Organisation::createConditions($this->Auth->user()) and appends the resulting ACL conditions to the picker query. Ordinary users are thereby limited to organisations associated with events or proposals they can already see, plus their own organisation, while users with the appropriate sharing-group privilege retain broader visibility. Version affected: ≤2.5.45
Title MISP Dashboard Organisation Picker Exposes Hidden Organisation Metadata to Unauthorized Users
Weaknesses CWE-200
CWE-862
References
Metrics cvssV4_0

{'score': 2.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: CIRCL

Published:

Updated: 2026-09-07T12:22:52.859Z

Reserved: 2026-09-07T12:22:51.171Z

Link: CVE-2026-86418

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-07T13:20:40.527

Modified: 2026-09-07T13:20:40.527

Link: CVE-2026-86418

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-07T14:30:17Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor

  • CWE-862

    Missing Authorization