CVE-2026-86441— MISP Dashboard Organisation Widgets Bypass Organisation-Index Restrictions and Expose Hidden Organisation Data
Quick assessment
Affected
MISP MISP
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
以下是该漏洞描述信息的中文翻译： 受影响版本的 MISP 中，仪表板上显示组织信息的组件之间存在不一致的授权检查。 几个与组织相关的组件未遵守 配置项。因此，即使正常的组织索引已被有意隐藏，拥有认证但缺少 权限的用户仍能够枚举（列出）各个组织。 受影响的组件包含以下路径： 返回组织名称和标识符； 由于无限制的 查询获取了完整的数据行，JSON 导出可能会暴露更多的组织数据库字段； 接受 或负数值，这在效果上等同于移除结果数量限制，从而返回整个组织表。 一个相关的“组织贡献者排行榜”组件也忽略了同样的可见性设置。其处
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-86441
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
MISP Dashboard Organisation Widgets Bypass Organisation-Index Restrictions and Expose Hidden Organisation Data
Source: CVE Program / CVE List V5
Vulnerability Description
Affected versions of MISP contain inconsistent authorization checks across dashboard widgets that display organisation information.
Several organisation-related widgets did not honor Security.hide_organisation_index_from_users. As a result, authenticated users without the perm_sharing_group permission could enumerate organisations even though the normal organisation index was intentionally hidden from them.
The affected widgets included paths that:
*
returned organisation names and identifiers;
*
could expose additional organisation database fields through JSON export because unrestricted find('all') queries fetched full rows;
*
accepted limit=0 or negative values in a way that could effectively remove the result limit and return the entire organisation table.
A related organisation-contributor leaderboard also ignored the same visibility setting. Its handler counted Event.orgc_id across the entire event table and mapped those IDs to organisation names, revealing every organisation with events regardless of whether the caller could see any of those events. The fix withdraws this widget entirely for users who lack organisation-index visibility.
Version affected: ≤2.5.45
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-86441
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-86441
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-86441 (2)
Same Patch Batch · MISP · 2026-09-07 · 11 CVEs total
| CVE-2026-86452 | 8.7 HIGH | MISP Unauthenticated Mail Endpoints Allow Unbounded Storage Consumption and Request Floodi |
| CVE-2026-86347 | 7.1 HIGH | MISP Missing Authorization on Template File Upload Allows Authenticated Disk Exhaustion |
| CVE-2026-86408 | 7.1 HIGH | MISP Missing Authorization in Cryptographic Key View Exposes Signing Keys from Protected E |
| CVE-2026-86419 | 7.0 HIGH | MISP Insufficient Outbound URL Validation Allows SSRF and Credential Disclosure via Feed R |
| CVE-2026-86342 | 5.3 MEDIUM | MISP Freetext Feed Preview Improper Authorization Exposes Restricted Event and Feed Inform |
| CVE-2026-86417 | 5.3 MEDIUM | MISP Dashboard Template REST API Exposes Template Owner Email Addresses to Unauthorized Us |
| CVE-2026-86451 | 5.3 MEDIUM | MISP Event Graph Object Reference Lookup Exposes References from Unauthorized Objects |
| CVE-2026-86351 | 5.1 MEDIUM | MISP User Homepage Validation Allows Authenticated Open Redirect via Protocol-Relative URL |
| CVE-2026-86440 | 5.1 MEDIUM | MISP Dashboard Button Widget Allows Stored XSS via Unsafe javascript: and Backslash URLs |
| CVE-2026-86418 | 2.3 LOW | MISP Dashboard Organisation Picker Exposes Hidden Organisation Metadata to Unauthorized Us |
IV. Related Vulnerabilities
Same product: MISP
-
CVE-2026-86452
MISP Unauthenticated Mail Endpoints Allow Unbounded Storage -
CVE-2026-86451
MISP Event Graph Object Reference Lookup Exposes References -
CVE-2026-86440
MISP Dashboard Button Widget Allows Stored XSS via Unsafe ja -
CVE-2026-86419
MISP Insufficient Outbound URL Validation Allows SSRF and Cr -
CVE-2026-86418
MISP Dashboard Organisation Picker Exposes Hidden Organisati
Same vendor: MISP
-
CVE-2026-86452
MISP Unauthenticated Mail Endpoints Allow Unbounded Storage -
CVE-2026-86451
MISP Event Graph Object Reference Lookup Exposes References -
CVE-2026-86440
MISP Dashboard Button Widget Allows Stored XSS via Unsafe ja -
CVE-2026-86419
MISP Insufficient Outbound URL Validation Allows SSRF and Cr -
CVE-2026-86418
MISP Dashboard Organisation Picker Exposes Hidden Organisati
Same weakness: CWE-862
-
CVE-2026-9331
EDD Product Catalog Feed by PixelYourSite <= 1.0.2 - Authent -
CVE-2026-77132
TYPO3 CMS - Information Disclosure via Backend Localization -
CVE-2026-85400
TYPO3 CMS - Missing Authorization in lowlevel commands -
CVE-2026-81781
WordPress Unbounce Landing Pages plugin <= 1.1.4 - Broken Ac -
CVE-2026-81790
WordPress Csomagpontok és szállítási címkék WooCommerce-hez
V. Comments for CVE-2026-86441
No comments yet