CVE-2026-86418 in MISP
Summary
by MITRE • 09/07/2026
Affected versions of MISP expose organisation metadata through the dashboard organisation picker without applying the same visibility restrictions enforced by the normal organisation index and per-organisation view.
The affected endpoint returned fields including:
* organisation ID;
* UUID;
* name.
When Security.hide_organisation_index_from_users was enabled, normal organisation enumeration was restricted, but the dashboard picker still queried all organisations. This allowed authenticated users to discover organisations that should have remained hidden from them.
The fix calls Organisation::createConditions($this->Auth->user()) and appends the resulting ACL conditions to the picker query. Ordinary users are thereby limited to organisations associated with events or proposals they can already see, plus their own organisation, while users with the appropriate sharing-group privilege retain broader visibility.
Version affected: ≤2.5.45
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/07/2026
The vulnerability identified in versions of MISP up to and including 2.5.45 represents a significant access control failure within the application's dashboard interface. Specifically, the organization picker widget used for selecting organizations during event creation or modification failed to enforce the same visibility restrictions that were applied to standard organization listing endpoints. This discrepancy created an information disclosure pathway where authenticated users could enumerate organizational entities that they should not have been able to see based on their assigned permissions and security policies. The exposed data included critical identifiers such as the organization ID, universally unique identifier (UUID), and name, which are essential for mapping relationships between different threat intelligence sharing communities.
The root cause of this flaw lies in the inconsistent application of access control lists across different parts of the MISP codebase. When the security configuration option hide_organisation_index_from_users was enabled to restrict users from viewing a full list of organizations, the backend logic correctly filtered results for standard index views and per-organization detail pages. However, the dashboard organization picker utilized a separate query path that did not inherit these restrictive conditions. Consequently, this endpoint returned all registered organizations regardless of whether the requesting user had any legitimate association with them through events or proposals. This inconsistency allowed attackers to bypass intended privacy controls by simply interacting with the dropdown menu in the interface rather than attempting to access restricted API endpoints directly.
From an operational impact perspective, this vulnerability facilitates unauthorized enumeration and reconnaissance activities within a threat intelligence sharing platform. By discovering hidden organizations, malicious actors can map out the structure of competing or private communities, identify potential targets for social engineering attacks, or gather context to craft more sophisticated spear-phishing campaigns against members of those organizations. The exposure of UUIDs further aids in linking disparate data points across different systems that may rely on these identifiers for integration purposes. This undermines the fundamental trust model of MISP, which relies on strict compartmentalization between sharing communities to protect sensitive intelligence and maintain operational security among participating entities.
This flaw aligns with CWE-284 Improper Access Control, as it involves a failure to properly restrict access to resources based on user privileges. Additionally, it relates to CWE-200 Information Exposure, where the application inadvertently reveals data about other organizations that should remain confidential. In terms of MITRE ATT&CK mapping, this vulnerability supports reconnaissance techniques categorized under T1592 Gather Victim Host Information or more broadly within initial access and discovery phases where adversaries seek to understand the target environment's structure before launching further attacks. The ability to enumerate hidden entities provides attackers with valuable intelligence that can be leveraged for subsequent exploitation steps against specific organizations identified through this enumeration process.
To mitigate this vulnerability, administrators must upgrade MISP to version 2.5.46 or later where the fix has been implemented. The patch resolves the issue by ensuring that the organization picker query applies the same access control conditions generated via Organisation::createConditions($this->Auth->user()). This logic restricts ordinary users to viewing only organizations associated with events or proposals they are authorized to see, along with their own primary organization. Users possessing specific sharing-group privileges retain broader visibility as intended by the security model. Beyond upgrading software, administrators should audit existing configurations to ensure that hide_organisation_index_from_users is properly set if minimizing organizational enumeration is a priority for their deployment environment. Regular review of access control policies and testing of permission boundaries across all interface components can help prevent similar inconsistencies in future updates or custom deployments.