CVE-2026-86417
Received Received - Intake

MISP Email Address Disclosure in Dashboard Templates

Publication date: 2026-09-07

Last updated on: 2026-09-07

Assigner: CIRCL

Description
Affected versions of MISP inconsistently enforced email-address visibility in DashboardsController::listTemplates(). The query always fetched User.email, while redaction happened only inside the non-REST rendering branch. As a result, the same authenticated user who saw redacted data in the normal HTML interface could request the REST/JSON representation and receive template owners’ email addresses without the intended privilege check. The fix moves the decision to a centralized User::canSeeEmails() authorization helper. Email addresses are now fetched only when the requester is a site administrator or the instance explicitly enables Security.disclose_user_emails. The same helper is also reused by other dashboard widgets to keep email-disclosure policy consistent. Version affected: ≤2.5.45

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-07
Last Modified
2026-09-07
Generated
2026-09-07
AI Q&A
2026-09-07
EPSS Evaluated
N/A
NVD
CVE-2026-86417
EUVD
EUVD-2026-72360

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
misp misp to 2.5.45 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in MISP (≤2.5.45) allowed authenticated users to bypass email redaction by requesting data via the REST API instead of the HTML interface. The system inconsistently enforced email visibility, exposing template owners' email addresses in JSON responses even when they should have been hidden.

Detection Guidance

Check MISP version with: grep '"version"' /var/www/MISP/app/Config/Config.php. If version is ≤2.5.45, the system is vulnerable. Inspect REST API responses for template owner emails by running: curl -H 'Authorization: YOUR_API_KEY' http://YOUR_MISP_URL/servers/getAllTemplates.json | grep email. If emails appear without admin privileges, the vulnerability is present.

Impact Analysis

If you use MISP ≤2.5.45, an attacker with valid credentials could access sensitive email addresses of other users through API requests. This could lead to privacy breaches or targeted phishing attacks against exposed individuals.

Compliance Impact

This vulnerability likely violates GDPR and HIPAA by exposing personal data (email addresses) without proper authorization. GDPR requires strict data access controls, and HIPAA mandates safeguards for protected health information. The flaw undermines compliance by allowing unauthorized access to sensitive data.

Mitigation Strategies

Upgrade MISP to version >2.5.45 immediately. If upgrading is not possible, apply the patch from https://github.com/MISP/MISP/commit/fd554c3bd.patch manually. Ensure Security.disclose_user_emails is set to false in app/Config/config.php to prevent email exposure.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86417. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart