CVE-2026-86441: MISP Information Disclosure Vulnerability

CVE-2026-86441 Overview

CVE-2026-86441 is an information disclosure vulnerability in MISP (Malware Information Sharing Platform) affecting versions ≤2.5.45. Several dashboard widgets that display organisation information did not honor the Security.hide_organisation_index_from_users configuration setting. Authenticated users without the perm_sharing_group permission could enumerate organisations even when the organisation index was intentionally hidden. The affected widgets returned organisation names and identifiers, exposed additional organisation database fields through JSON export, and accepted limit=0 or negative values that removed result limits entirely. This vulnerability is classified under [CWE-200] Information Exposure.

Critical Impact
Authenticated MISP users lacking sharing-group permissions can enumerate the entire organisation directory, defeating the visibility control intended by Security.hide_organisation_index_from_users.

Affected Products

MISP (misp-project) versions ≤2.5.45
Deployments with Security.hide_organisation_index_from_users enabled
Dashboard widgets: NewOrgsWidget, OrgsContributorsGeneric, OrgContributionToplistWidget

Discovery Timeline

2026-09-07 - CVE-2026-86441 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-86441

Vulnerability Analysis

The vulnerability stems from inconsistent authorization checks across MISP dashboard widgets that surface organisation metadata. MISP provides Security.hide_organisation_index_from_users to withhold the organisation directory from users without the perm_sharing_group permission. The organisations/index endpoint honors this setting, but several dashboard widgets bypassed it entirely.

The NewOrgsWidget handler ran unrestricted find('all') queries against the Organisation model. Because the results were serialized to JSON, callers received full database rows rather than only the intended display fields. The same handler used isset($options['limit']) rather than empty(), allowing a limit=0 or limit=-1 parameter to suppress the SQL LIMIT clause and return the entire organisations table in a single request.

The OrgContributionToplistWidget counted Event.orgc_id across the entire events table and mapped identifiers back to organisation names. This exposed every organisation with any event, regardless of whether the caller could see those events.

Root Cause

The root cause is a missing checkPermissions() gate on organisation-related widgets. The widgets did not mirror the predicate used by ACLComponent.php:1171 for the organisation_index dynamic check. Additionally, the limit parameter was parsed without a lower bound, and sprintf('%u') converted negative values into large unsigned integers, effectively disabling pagination.

Attack Vector

An authenticated user without perm_sharing_group permission on an instance running Security.hide_organisation_index_from_users loads a dashboard containing an affected widget, or invokes the widget's exportjson endpoint. The response returns organisation identifiers, names, and additional database fields that the setting was meant to withhold.

php

// Patch: app/Lib/Dashboard/OrgsContributorsGeneric.php
// Adds the missing permission gate on organisation widgets
public function checkPermissions($user)
{
    if (Configure::read('Security.hide_organisation_index_from_users')) {
        return !empty($user['Role']['perm_sharing_group']);
    }
    return true;
}

Source: MISP commit 67892d90e

php

// Patch: app/Lib/Dashboard/NewOrgsWidget.php
// empty() replaces isset() so limit=0 and limit=-1 no longer drop the LIMIT clause
$data = $this->Organisation->find('all', [
    'recursive' => -1,
    'conditions' => $params['conditions'],
    'limit' => empty($options['limit']) ? 10 : (int)$options['limit'],
    'fields' => array_keys($fields),
    'order' => 'Organisation.date_created DESC'
]);

Source: MISP commit 67892d90e

Detection Methods for CVE-2026-86441

Indicators of Compromise

Dashboard widget requests to NewOrgsWidget, OrgsContributorsGeneric, or OrgContributionToplistWidget from users lacking perm_sharing_group.
HTTP requests containing limit=0, limit=-1, or unusually large limit values against dashboard widget endpoints.
exportjson requests returning organisation records with fields beyond id and name.

Detection Strategies

Review MISP application logs for widget handler invocations correlated with user roles that lack the sharing-group permission.
Alert on dashboard widget responses whose payload size is disproportionate to the configured limit value.
Compare active MISP version against 2.5.45 to identify unpatched instances.

Monitoring Recommendations

Instrument reverse-proxy access logs to capture limit query parameters on dashboard endpoints.
Track user role assignments and flag accounts that access organisation widgets without perm_sharing_group.
Forward MISP audit logs to a centralized SIEM for retention and correlation across dashboard activity.

How to Mitigate CVE-2026-86441

Immediate Actions Required

Upgrade MISP to a version that includes commits 5e333a159 and 67892d90e, above the 2.5.45 affected range.
Audit dashboard configurations and remove OrgContributionToplistWidget from shared boards on instances where organisation visibility must be restricted.
Review user roles and confirm that perm_sharing_group is granted only to accounts that require organisation directory visibility.

Patch Information

MISP maintainers released two commits addressing the vulnerability. Commit 5e333a159 withdraws OrgContributionToplistWidget for users lacking organisation-index visibility by returning false from checkPermissions(). Commit 67892d90e adds the same permission gate to NewOrgsWidget and OrgsContributorsGeneric, and replaces isset() with empty() on the limit parameter to prevent bypass via zero or negative values.

Workarounds

Remove the affected widgets from all shared dashboards until the patch is applied.
Restrict dashboard access to trusted user roles that already have perm_sharing_group permission.
Place MISP behind a reverse proxy that rejects requests containing limit=0 or negative limit parameters on widget endpoints.

bash

# Verify the installed MISP version and apply the upstream patches
cd /var/www/MISP
git fetch origin
git log --oneline | grep -E "5e333a159|67892d90e"
# If commits are absent, update to a fixed release
sudo -u www-data git pull origin 2.5