Description
Affected versions of MISP expose organisation metadata through the dashboard organisation picker without applying the same visibility restrictions enforced by the normal organisation index and per-organisation view.

The affected endpoint returned fields including:

 - organisation ID;

 - UUID;

 - name.






When Security.hide_organisation_index_from_users was enabled, normal organisation enumeration was restricted, but the dashboard picker still queried all organisations. This allowed authenticated users to discover organisations that should have remained hidden from them.


The fix calls Organisation::createConditions($this->Auth->user()) and appends the resulting ACL conditions to the picker query. Ordinary users are thereby limited to organisations associated with events or proposals they can already see, plus their own organisation, while users with the appropriate sharing-group privilege retain broader visibility.




Version affected: ≤2.5.45
Published: 2026-09-07
Score: 2.3 Low
EPSS: < 1% Very Low
KEV: No
Impact: Information Disclosure
Action: Patch
AI Analysis

Impact

The vulnerability in MISP affects versions up to 2.5.45. The dashboard organisation picker incorrectly returns organisation metadata – ID, UUID, and name – for all organisations regardless of visibility restrictions that normally apply to the organisation index and per‑organisation view. When Security.hide_organisation_index_from_users is enabled, standard enumeration is restricted, yet the picker still queries every organisation that should remain hidden. The implemented fix applies ACL conditions from Organisation::createConditions for the logged‑in user, limiting ordinary users to organisations they can already see or their own, while users with a sharing‑group privilege retain broader visibility.

Affected Systems

MISP MISP, all releases up to and including version 2.5.45. Administrators should check the exact MISP version; any version ≤ 2.5.45 is vulnerable and requires remediation.

Risk and Exploitability

The CVSS score of 2.3 indicates low severity, and the EPSS score is < 1%. The vulnerability is not listed in the CISA KEV catalog, suggesting no evidence of widespread exploitation. The flaw requires authenticated access but can be triggered via the web interface. Once the public patch is applied, the ACL conditions are appended to the picker query, restricting visibility to organisations a user can already see. Consequently, the risk is limited to information disclosure to authorised users and does not allow remote code execution or privilege escalation.

Generated by OpenCVE AI on September 21, 2026 at 05:24 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update MISP to a fixed version (≥ 2.5.46) or apply the security patch from the commit 8ca4486af to enforce ACL conditions on the organisation picker.
  • Ensure that the Security.hide_organisation_index_from_users configuration setting is enabled and that no custom code bypasses the ACL conditions added by Organisation::createConditions for the picker query.
  • Implement monitoring of the dashboard organization picker API to detect and alert on attempts to enumerate hidden organizations by authenticated users.

Generated by OpenCVE AI on September 21, 2026 at 05:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 14 Sep 2026 07:00:00 +0000

Type Values Removed Values Added
Description Affected versions of MISP expose organisation metadata through the dashboard organisation picker without applying the same visibility restrictions enforced by the normal organisation index and per-organisation view. The affected endpoint returned fields including: * organisation ID; * UUID; * name. When Security.hide_organisation_index_from_users was enabled, normal organisation enumeration was restricted, but the dashboard picker still queried all organisations. This allowed authenticated users to discover organisations that should have remained hidden from them. The fix calls Organisation::createConditions($this->Auth->user()) and appends the resulting ACL conditions to the picker query. Ordinary users are thereby limited to organisations associated with events or proposals they can already see, plus their own organisation, while users with the appropriate sharing-group privilege retain broader visibility. Version affected: ≤2.5.45 Affected versions of MISP expose organisation metadata through the dashboard organisation picker without applying the same visibility restrictions enforced by the normal organisation index and per-organisation view. The affected endpoint returned fields including:  - organisation ID;  - UUID;  - name. When Security.hide_organisation_index_from_users was enabled, normal organisation enumeration was restricted, but the dashboard picker still queried all organisations. This allowed authenticated users to discover organisations that should have remained hidden from them. The fix calls Organisation::createConditions($this->Auth->user()) and appends the resulting ACL conditions to the picker query. Ordinary users are thereby limited to organisations associated with events or proposals they can already see, plus their own organisation, while users with the appropriate sharing-group privilege retain broader visibility. Version affected: ≤2.5.45

Wed, 09 Sep 2026 15:45:00 +0000

Type Values Removed Values Added
First Time appeared Misp-project
Misp-project misp
CPEs cpe:2.3:a:misp-project:misp:*:*:*:*:*:*:*:*
Vendors & Products Misp-project
Misp-project misp
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'}

Tue, 08 Sep 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 07 Sep 2026 15:00:00 +0000

Type Values Removed Values Added
First Time appeared Misp
Misp misp
Vendors & Products Misp
Misp misp

Mon, 07 Sep 2026 12:30:00 +0000

Type Values Removed Values Added
Description Affected versions of MISP expose organisation metadata through the dashboard organisation picker without applying the same visibility restrictions enforced by the normal organisation index and per-organisation view. The affected endpoint returned fields including: * organisation ID; * UUID; * name. When Security.hide_organisation_index_from_users was enabled, normal organisation enumeration was restricted, but the dashboard picker still queried all organisations. This allowed authenticated users to discover organisations that should have remained hidden from them. The fix calls Organisation::createConditions($this->Auth->user()) and appends the resulting ACL conditions to the picker query. Ordinary users are thereby limited to organisations associated with events or proposals they can already see, plus their own organisation, while users with the appropriate sharing-group privilege retain broader visibility. Version affected: ≤2.5.45
Title MISP Dashboard Organisation Picker Exposes Hidden Organisation Metadata to Unauthorized Users
Weaknesses CWE-200
CWE-862
References
Metrics cvssV4_0

{'score': 2.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Misp Misp
Misp-project Misp
cve-icon MITRE

Status: PUBLISHED

Assigner: CIRCL

Published:

Updated: 2026-09-14T06:36:34.979Z

Reserved: 2026-09-07T12:22:51.171Z

Link: CVE-2026-86418

cve-icon Vulnrichment

Updated: 2026-09-08T14:50:40.578Z

cve-icon NVD

Status : Modified

Published: 2026-09-07T13:20:40.527

Modified: 2026-09-14T07:17:23.147

Link: CVE-2026-86418

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-21T05:30:07Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor

  • CWE-862

    Missing Authorization