CVE-2026-86418— MISP Dashboard Organisation Picker Exposes Hidden Organisation Metadata to Unauthorized Users
Quick assessment
Affected
MISP MISP
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
以下是该漏洞描述的中文翻译： MISP 受影响的版本中，仪表板（Dashboard）中的组织选择器（organisation picker）在展示组织元数据时，未应用与常规组织索引及单组织视图所强制执行的相同可见性限制。 受影响的端点返回了以下字段： 组织 ID； UUID； 名称。 当启用 配置时，常规的组织枚举被限制，但仪表板选择器仍会查询所有组织。这使得已认证用户能够发现本应对其隐藏的组织。 修复方案调用 ，并将由此生成的访问控制列表（ACL）条件追加到选择器的查询中。这样一来，普通用户仅能查看与其已可见事件
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-86418
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
MISP Dashboard Organisation Picker Exposes Hidden Organisation Metadata to Unauthorized Users
Source: CVE Program / CVE List V5
Vulnerability Description
Affected versions of MISP expose organisation metadata through the dashboard organisation picker without applying the same visibility restrictions enforced by the normal organisation index and per-organisation view.
The affected endpoint returned fields including:
*
organisation ID;
*
UUID;
*
name.
When Security.hide_organisation_index_from_users was enabled, normal organisation enumeration was restricted, but the dashboard picker still queried all organisations. This allowed authenticated users to discover organisations that should have remained hidden from them.
The fix calls Organisation::createConditions($this->Auth->user()) and appends the resulting ACL conditions to the picker query. Ordinary users are thereby limited to organisations associated with events or proposals they can already see, plus their own organisation, while users with the appropriate sharing-group privilege retain broader visibility.
Version affected: ≤2.5.45
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
信息暴露
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-86418
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-86418
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-86418 (1)
Same Patch Batch · MISP · 2026-09-07 · 11 CVEs total
| CVE-2026-86452 | 8.7 HIGH | MISP Unauthenticated Mail Endpoints Allow Unbounded Storage Consumption and Request Floodi |
| CVE-2026-86347 | 7.1 HIGH | MISP Missing Authorization on Template File Upload Allows Authenticated Disk Exhaustion |
| CVE-2026-86408 | 7.1 HIGH | MISP Missing Authorization in Cryptographic Key View Exposes Signing Keys from Protected E |
| CVE-2026-86419 | 7.0 HIGH | MISP Insufficient Outbound URL Validation Allows SSRF and Credential Disclosure via Feed R |
| CVE-2026-86342 | 5.3 MEDIUM | MISP Freetext Feed Preview Improper Authorization Exposes Restricted Event and Feed Inform |
| CVE-2026-86417 | 5.3 MEDIUM | MISP Dashboard Template REST API Exposes Template Owner Email Addresses to Unauthorized Us |
| CVE-2026-86451 | 5.3 MEDIUM | MISP Event Graph Object Reference Lookup Exposes References from Unauthorized Objects |
| CVE-2026-86351 | 5.1 MEDIUM | MISP User Homepage Validation Allows Authenticated Open Redirect via Protocol-Relative URL |
| CVE-2026-86440 | 5.1 MEDIUM | MISP Dashboard Button Widget Allows Stored XSS via Unsafe javascript: and Backslash URLs |
| CVE-2026-86441 | 2.3 LOW | MISP Dashboard Organisation Widgets Bypass Organisation-Index Restrictions and Expose Hidd |
IV. Related Vulnerabilities
Same product: MISP
-
CVE-2026-86452
MISP Unauthenticated Mail Endpoints Allow Unbounded Storage -
CVE-2026-86451
MISP Event Graph Object Reference Lookup Exposes References -
CVE-2026-86441
MISP Dashboard Organisation Widgets Bypass Organisation-Inde -
CVE-2026-86440
MISP Dashboard Button Widget Allows Stored XSS via Unsafe ja -
CVE-2026-86419
MISP Insufficient Outbound URL Validation Allows SSRF and Cr
Same vendor: MISP
-
CVE-2026-86452
MISP Unauthenticated Mail Endpoints Allow Unbounded Storage -
CVE-2026-86451
MISP Event Graph Object Reference Lookup Exposes References -
CVE-2026-86441
MISP Dashboard Organisation Widgets Bypass Organisation-Inde -
CVE-2026-86440
MISP Dashboard Button Widget Allows Stored XSS via Unsafe ja -
CVE-2026-86419
MISP Insufficient Outbound URL Validation Allows SSRF and Cr
Same weakness: CWE-200
-
CVE-2026-86519
code-projects Student Crud Operation Backup File card_activa -
CVE-2026-86308
light0011 cms Debug Mode config.php information disclosure -
CVE-2026-86417
MISP Dashboard Template REST API Exposes Template Owner Emai -
CVE-2026-86302
code-projects Hospital Information System SQL Database Backu -
CVE-2026-86284
jaychouchannel Tourism-Management-System CommonController.ja
V. Comments for CVE-2026-86418
No comments yet