CVE-2026-86417: MISP Dashboard Template REST API Exposes Template Owner Email Addresses to Unauthorized Users
Affected versions of MISP inconsistently enforced email-address visibility in DashboardsController::listTemplates().
The query always fetched User.email, while redaction happened only inside the non-REST rendering branch. As a result, the same authenticated user who saw redacted data in the normal HTML interface could request the REST/JSON representation and receive template owners’ email addresses without the intended privilege check.
The fix moves the decision to a centralized User::canSeeEmails() authorization helper. Email addresses are now fetched only when the requester is a site administrator or the instance explicitly enables Security.discloseuseremails. The same helper is also reused by other dashboard widgets to keep email-disclosure policy consistent.
Version affected: ≤2.5.45
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Ensure the instance only discloses user email addresses when explicitly required by setting Security.disclose_user_emails. If you do not want email disclosure, keep Security.disclose_user_emails disabled so template owners’ email addresses are not returned via the Dashboard Template REST/JSON API.
MISP Security.disclose_user_emails = enabled only when instance explicitly enables Security.disclose_user_emails - Compensating control
Until upgraded, restrict access to the MISP Dashboard Template REST API endpoints (e.g., Dashboard Templates REST/JSON) so only site administrators can access them, since non-admin authenticated users could otherwise receive template owners’ email addresses.
Event History
Frequently Asked Questions
Who can retrieve the exposed email addresses?
Any authenticated user who can request the dashboard template REST/JSON representation may receive template owners’ email addresses. The issue does not require site-administrator privileges.
Are default deployments affected?
Affected versions through 2.5.45 are affected when dashboard template data is available to authenticated users, because the REST endpoint fetched User.email regardless of the intended email-visibility policy.
What changes in the fixed behavior?
Email addresses are included only for site administrators or when the instance explicitly enables Security.disclose_user_emails. Other requesters should no longer receive owner email fields from the dashboard template REST response.
How can an administrator assess possible exposure?
Review access and request logs for authenticated requests to the dashboard template REST/JSON listing endpoint, particularly from non-administrative accounts. Compare returned JSON from an affected instance to determine whether template owner email fields were present.