CVEFinder.io

CVE-2026-86418

🔶 medium
🔍 Scan for this CVE
Summary

Affected versions of MISP expose organisation metadata through the dashboard organisation picker without applying the same visibility restrictions enforced by the normal organisation index and per-organisation view. The affected endpoint returned fields including:  - organisation ID;  - UUID;  - name. When Security.hide_organisation_index_from_users was enabled, normal organisation enumeration was restricted, but the dashboard picker still queried all organisations. This allowed authen

Description

Affected versions of MISP expose organisation metadata through the dashboard organisation picker without applying the same visibility restrictions enforced by the normal organisation index and per-organisation view.

The affected endpoint returned fields including:

 - organisation ID;

 - UUID;

 - name.






When Security.hide_organisation_index_from_users was enabled, normal organisation enumeration was restricted, but the dashboard picker still queried all organisations. This allowed authenticated users to discover organisations that should have remained hidden from them.


The fix calls Organisation::createConditions($this->Auth->user()) and appends the resulting ACL conditions to the picker query. Ordinary users are thereby limited to organisations associated with events or proposals they can already see, plus their own organisation, while users with the appropriate sharing-group privilege retain broader visibility.




Version affected: ≤2.5.45

CVSS Score
4.3
Medium
EPSS Score
0.2
Exploit Probability
Published Date
2026-09-07
First Seen: 2026-09-08
📊 Relative Risk Intelligence

This CVE is Lower Risk - more severe than 5.3% of all 360,673 vulnerabilities in our database.

#341,411
Below average severity
Severity Percentile
🎯 CISA SSVC Assessment Updated: Sep 8, 2026
🔍 Exploitation Status
None
No known exploits
⚙️ Automatable
NO
Requires human interaction
💥 Technical Impact
Partial
Limited system impact
🏆 Discovered By
Scottish Government - National Cyber Team iglocska (remediation developer) Claude Opus 5 (1M context) (remediation developer)
SSVC data provided by CISA
Last Modified 2026-09-14
Source NVD 🔗
CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS Vector 4.0 CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CWE IDs (Weakness Types)

📦 Affected Products 1

🔗 References 1

🔗 Related CVEs 6

CVE ID Severity CVSS EPSS Summary Published
CVE-2026-86342 🔶 medium 4.3 0.2 Affected versions of MISP contain improper authorization checks in the freetext feed preview functionality. The preview ... 2026-09-07
CVE-2026-86347 🔶 medium 6.5 0.3 Affected versions of MISP allow any authenticated user to access TemplatesController::uploadFile() because the ACL entry... 2026-09-07
CVE-2026-86351 🔶 medium 6.1 0.2 Affected versions of MISP validate the user-configurable homepage by checking only whether the supplied path begins with... 2026-09-07
CVE-2026-86408 🔶 medium 6.5 0.2 Affected versions of MISP do not enforce parent-event visibility when serving cryptographic keys through CryptographicKe... 2026-09-07
CVE-2026-86417 🔶 medium 4.3 0.2 Affected versions of MISP inconsistently enforced email-address visibility in DashboardsController::listTemplates(). T... 2026-09-07
CVE-2026-86419 ⛔ critical 9.1 0.2 Affected versions of MISP contain insufficient validation of server-side outbound HTTP destinations in feed retrieval an... 2026-09-07
These CVEs affect the same products