CVE-2026-86417: MISP Dashboard Template REST API Exposes Template Owner Email Addresses to Unauthorized Users
Affected versions of MISP inconsistently enforced email-address visibility in DashboardsController::listTemplates().
The query always fetched User.email, while redaction happened only inside the non-REST rendering branch. As a result, the same authenticated user who saw redacted data in the normal HTML interface could request the REST/JSON representation and receive template owners’ email addresses without the intended privilege check.
The fix moves the decision to a centralized User::canSeeEmails() authorization helper. Email addresses are now fetched only when the requester is a site administrator or the instance explicitly enables Security.discloseuseremails. The same helper is also reused by other dashboard widgets to keep email-disclosure policy consistent.
Version affected: ≤2.5.45
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MISPto a version that resolves this vulnerability.Fixed in ≤2.5.45 - Configuration
If you want non-site-admin users to see template owner email addresses, explicitly enable Security.disclose_user_emails on the instance; otherwise keep it disabled so email is fetched only for site administrators.
MISP Security.disclose_user_emails = (enabled only if intended)
Event History
Frequently Asked Questions
Who can retrieve the exposed email addresses?
Any authenticated user who can request the dashboard template REST/JSON representation may receive template owners’ email addresses. The issue does not require site-administrator privileges.
Are default deployments affected?
Affected versions through 2.5.45 are affected when dashboard template data is available to authenticated users, because the REST endpoint fetched User.email regardless of the intended email-visibility policy.
What changes in the fixed behavior?
Email addresses are included only for site administrators or when the instance explicitly enables Security.disclose_user_emails. Other requesters should no longer receive owner email fields from the dashboard template REST response.
How can an administrator assess possible exposure?
Review access and request logs for authenticated requests to the dashboard template REST/JSON listing endpoint, particularly from non-administrative accounts. Compare returned JSON from an affected instance to determine whether template owner email fields were present.