CVE-2026-86417: MISP Information Disclosure Vulnerability

CVE-2026-86417 Overview

CVE-2026-86417 is an information disclosure vulnerability in Malware Information Sharing Platform (MISP) versions ≤2.5.45. The flaw resides in DashboardsController::listTemplates(), which inconsistently enforced email-address visibility depending on the response rendering mode. Authenticated users who received redacted data through the HTML interface could request the REST/JSON representation of the same endpoint and receive template owners' email addresses without the intended privilege check. The vulnerability is classified under [CWE-200] Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Any authenticated MISP user can enumerate dashboard template owners' email addresses by requesting the REST/JSON representation, bypassing the redaction applied in the HTML rendering path.

Affected Products

MISP (misp-project) versions ≤2.5.45
MISP instances exposing the Dashboards REST/JSON endpoints
Deployments without Security.disclose_user_emails explicitly enabled

Discovery Timeline

2026-09-07 - CVE-2026-86417 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-86417

Vulnerability Analysis

The vulnerability stems from a mismatch between data retrieval and data redaction logic in the DashboardsController::listTemplates() action. The controller query always fetched User.email into the result set, delegating redaction to a display-time afterFind callback. That callback only applied redaction inside the !$this->_isRest() branch, meaning the JSON/REST response path returned unredacted email addresses.

Because the REST mode is selected by the caller through the URL suffix or Accept header, the redaction condition acted as a rendering decision rather than an authorization boundary. Any authenticated session could switch to JSON output and read template owners' email addresses that the HTML view had hidden.

Root Cause

The root cause is [CWE-200] Information Exposure caused by placing an authorization check inside a rendering-mode branch. The fix introduces a centralized User::canSeeEmails() helper. Email columns are fetched only when the requester is a site administrator or the instance has Security.disclose_user_emails enabled. The same helper is reused by other dashboard widgets to keep email-disclosure policy consistent.

Attack Vector

An authenticated low-privilege MISP user issues a request to the dashboard templates listing endpoint with a JSON suffix or Accept: application/json header. The response includes User.email for each template owner. No user interaction or elevated privileges are required beyond a valid MISP account.

php

         }
 
         $currentUserId = $this->Auth->user('id');
+        // Template owners' e-mail addresses are a privilege decision, not a
+        // rendering one. The redaction used to sit inside the !_isRest()
+        // branch of afterFind() below, so the same session returned the
+        // addresses verbatim the moment it asked for JSON - and _isRest() is
+        // chosen by the caller (URL suffix / Accept header), so it never was
+        // a boundary. Decide it here instead, on the same rule the two
+        // e-mail-bearing dashboard widgets use, and simply do not fetch the
+        // column when it may not be shown - the shape ObjectTemplatesController
+        // ::view() already uses for exactly this field.
+        App::uses('User', 'Model');
+        $contain = ['User.id'];
+        if (User::canSeeEmails($this->Auth->user())) {
+            $contain[] = 'User.email';
+        }
         $params = [
             'filters' => ['name', 'description', 'uuid', 'value'],
             'quickFilters' => ['name', 'description', 'uuid'],
             'quickFilterParameter' => 'value',
             'conditions' => $conditions,
-            'contain' => ['User.id', 'User.email'],
-            'afterFind' => function ($data) use ($accessible_widgets, $currentUserId) {
+            'contain' => $contain,
+            'afterFind' => function ($data) use ($accessible_widgets) {
                 foreach ($data as &$element) {
                     $element['Dashboard']['value'] = json_decode($element['Dashboard']['value'], true);
                     if (!$this->_isRest()) {

Source: MISP commit fd554c3bd — the patch moves the authorization decision to User::canSeeEmails() and excludes the email column from the query when disclosure is not permitted.

Detection Methods for CVE-2026-86417

Indicators of Compromise

Requests to /dashboards/listTemplates.json or /dashboards/listTemplates with Accept: application/json originating from non-administrator accounts.
JSON responses from the dashboards controller containing populated User.email fields when the requester lacks site-admin role.
Repeated enumeration patterns against the dashboards templates endpoint from a single session or IP.

Detection Strategies

Review MISP web server access logs for listTemplates requests using the .json suffix or JSON Accept headers from low-privilege user sessions.
Correlate the requesting user's role with the returned response payload size or structure to identify unauthorized email disclosure.
Baseline normal REST consumers of the dashboard endpoints and alert on new principals invoking listTemplates via REST.

Monitoring Recommendations

Enable MISP audit logging for the Dashboards controller and forward logs to a centralized log platform.
Alert on any authenticated user without perm_site_admin retrieving JSON dashboard template listings prior to patching.
Monitor for spikes in outbound traffic to REST endpoints that historically served only HTML consumers.

How to Mitigate CVE-2026-86417

Immediate Actions Required

Upgrade MISP to a version above 2.5.45 that contains commit fd554c3bd.
Audit existing MISP user accounts and remove inactive or unnecessary accounts to reduce the exposure surface.
Review historical access logs for unauthorized REST calls to listTemplates and rotate exposed contact addresses if abuse is suspected.

Patch Information

The fix is available in the MISP commit fd554c3bd. The patch introduces User::canSeeEmails() in app/Controller/DashboardsController.php and refactors app/Lib/Dashboard/NewUsersWidget.php to consume the same helper, ensuring email visibility is enforced consistently across dashboard components.

Workarounds

Confirm Security.disclose_user_emails is set to false in config.php so that only site administrators can trigger email fetching once the patch is applied.
Restrict access to the MISP REST API using reverse-proxy access controls until the upgrade is deployed.
Limit MISP account creation and enforce role-based access reviews to reduce the pool of authenticated users who could abuse the endpoint.

bash

# Apply the upstream security patch to a MISP checkout
cd /var/www/MISP
sudo -u www-data git fetch origin
sudo -u www-data git cherry-pick fd554c3bd

# Verify email disclosure policy in config.php
grep -n "disclose_user_emails" /var/www/MISP/app/Config/config.php
# Expected: 'disclose_user_emails' => false,