CVE-2026-86418: MISP Information Disclosure Vulnerability

CVE-2026-86418 Overview

CVE-2026-86418 is an information disclosure vulnerability in MISP (Malware Information Sharing Platform) versions ≤2.5.45. The dashboard organisation picker endpoint returned organisation metadata without enforcing the same access control (ACL) checks used by the standard organisation index. Authenticated users could enumerate organisation IDs, UUIDs, and names that administrators had explicitly hidden through the Security.hide_organisation_index_from_users setting. The flaw is tracked as CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Authenticated MISP users can enumerate hidden organisation metadata (ID, UUID, name) through the dashboard picker, bypassing the hide_organisation_index_from_users restriction intended to isolate tenants.

Affected Products

MISP versions ≤2.5.45
Deployments with Security.hide_organisation_index_from_users enabled
Multi-tenant MISP instances relying on organisation visibility controls

Discovery Timeline

2026-09-07 - CVE-2026-86418 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-86418

Vulnerability Analysis

MISP provides the Security.hide_organisation_index_from_users configuration to restrict organisation enumeration for standard users. When enabled, requests to /organisations/index are refused, and Organisation::canSee() gates per-organisation detail views. The searchOrganisations() method in app/Controller/DashboardsController.php powers a dashboard widget picker and shares the same read-only * ACL policy as other dashboard endpoints. However, the picker query returned every organisation regardless of visibility settings, ignoring the ACL layer applied elsewhere in the application.

The returned records included the organisation ID, UUID, and name, which are the same identifiers used to correlate events, proposals, and sharing groups. Attackers holding any authenticated account could therefore build a full inventory of tenant organisations on the instance.

Root Cause

The picker endpoint assumed that organisation names and UUIDs were non-sensitive because they are exposed through the standard organisation index. That assumption fails when the administrator opts into hiding the index. The controller method did not call Organisation::createConditions($this->Auth->user()) to append the user's ACL conditions to the query.

Attack Vector

Exploitation requires an authenticated session (PR:L) and network access to the MISP web interface. An attacker calls the dashboard picker endpoint and parses the JSON response to enumerate every organisation, including those the administrator intended to hide.

php

     *      name: string }, ...]
     *
     * Read-only; same '*' ACL policy as the other dashboard picker
-    * endpoints. Organisation names + UUIDs are not sensitive (any
-    * MISP user can already see them via the org index page); per-
-    * org event/attribute ACL is enforced downstream by the
-    * consumer widget's query path against an already-ACL-filtered
-    * base set. Result order: name ASC for deterministic UX.
+    * endpoints, but the result set is scoped: organisation names are
+    * only non-sensitive while `Security.hide_organisation_index_from_users`
+    * is off. With it on, `/organisations/index` refuses outright and
+    * `Organisation::canSee()` gates the per-organisation view, so this
+    * picker honours the same control via `createConditions()`. Per-org
+    * event/attribute ACL is still enforced downstream by the consumer
+    * widget's query path against an already-ACL-filtered base set.
+    * Result order: name ASC for deterministic UX.
     */
    public function searchOrganisations()
    {

Source: MISP commit 8ca4486af. The patch scopes picker results by calling createConditions() so ordinary users only see organisations tied to events or proposals they can already access, plus their own organisation.

Detection Methods for CVE-2026-86418

Indicators of Compromise

Unexpected HTTP requests to the dashboard searchOrganisations endpoint from low-privilege user accounts.
Application logs showing organisation picker queries that return counts exceeding the number of organisations the requesting user should see.
Follow-on activity referencing organisation UUIDs the user has no legitimate association with.

Detection Strategies

Review MISP web server access logs for POST or GET requests to /dashboards/searchOrganisations and correlate with the requesting user's role.
Compare picker response volume against the user's visible event and proposal scope to identify anomalous enumeration.
Alert on repeated dashboard picker calls originating from a single session within short time windows.

Monitoring Recommendations

Enable verbose MISP audit logging for controller actions in DashboardsController.
Forward MISP application and web logs to a centralized log analytics platform for correlation with authentication events.
Track baseline picker usage per user role and flag deviations that indicate reconnaissance.

How to Mitigate CVE-2026-86418

Immediate Actions Required

Upgrade MISP to a release that includes commit 8ca4486af (post-2.5.45).
Audit user accounts with dashboard access and remove unused or stale credentials.
Review historical logs for enumeration attempts against the dashboard picker endpoint.

Patch Information

The fix is delivered via commit 8ca4486af in app/Controller/DashboardsController.php. It appends the result of Organisation::createConditions($this->Auth->user()) to the picker query so ACL constraints are enforced consistently with the organisation index and per-organisation view. Users with sharing-group privileges retain broader visibility as expected.

Workarounds

Restrict web access to the MISP instance to trusted networks until the patch is applied.
Limit dashboard widget usage for user roles that do not require organisation selection.
Where feasible, disable the affected dashboard widgets that rely on the picker endpoint.

bash

# Verify installed MISP version and pull the security patch
cd /var/www/MISP
sudo -u www-data git fetch origin
sudo -u www-data git log --oneline | grep 8ca4486af
sudo -u www-data git pull origin 2.5