CVE-2026-86441
Received Received - Intake

Inconsistent Authorization in MISP Organisation Widgets

Publication date: 2026-09-07

Last updated on: 2026-09-07

Assigner: CIRCL

Description
Affected versions of MISP contain inconsistent authorization checks across dashboard widgets that display organisation information. Several organisation-related widgets did not honor Security.hide_organisation_index_from_users. As a result, authenticated users without the perm_sharing_group permission could enumerate organisations even though the normal organisation index was intentionally hidden from them. The affected widgets included paths that: * returned organisation names and identifiers; * could expose additional organisation database fields through JSON export because unrestricted find('all') queries fetched full rows; * accepted limit=0 or negative values in a way that could effectively remove the result limit and return the entire organisation table. A related organisation-contributor leaderboard also ignored the same visibility setting. Its handler counted Event.orgc_id across the entire event table and mapped those IDs to organisation names, revealing every organisation with events regardless of whether the caller could see any of those events. The fix withdraws this widget entirely for users who lack organisation-index visibility. Version affected: ≤2.5.45

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-07
Last Modified
2026-09-07
Generated
2026-09-07
AI Q&A
2026-09-07
EPSS Evaluated
N/A
NVD
CVE-2026-86441
EUVD
EUVD-2026-72374

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
misp misp to 2.5.45 (inc)
misp misp to 2.5.45 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in MISP versions 2.5.45 or earlier involves inconsistent authorization checks in organisation-related dashboard widgets. Authenticated users without specific permissions could enumerate organisations even when access was restricted. Some widgets exposed full database fields via unrestricted queries, and others allowed bypassing result limits to retrieve entire organisation tables.

Detection Guidance

To detect this vulnerability, check if authenticated users without perm_sharing_group can access organisation-related widgets or enumerate organisations despite Security.hide_organisation_index_from_users being enabled. Review MISP logs for unauthorised access to organisation data via widgets or JSON exports. Verify if limit=0 or negative values return full organisation tables.

Impact Analysis

An attacker with authenticated access could list hidden organisations, exposing sensitive data like names and identifiers. They might also retrieve full database records or bypass pagination limits to access all organisations. This could lead to unauthorised information disclosure about organisations in the system.

Compliance Impact

This vulnerability could violate data protection requirements by exposing unauthorised access to organisation data. GDPR and HIPAA mandate strict access controls and data minimisation; unauthorised enumeration risks non-compliance, potential fines, and reputational damage due to data breaches.

Mitigation Strategies

Upgrade MISP to a version newer than 2.5.45 to address the authorization bypass in organisation-related widgets.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86441. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart