CVE-2026-86418: MISP Dashboard Organisation Picker Exposes Hidden Organisation Metadata to Unauthorized Users
Affected versions of MISP expose organisation metadata through the dashboard organisation picker without applying the same visibility restrictions enforced by the normal organisation index and per-organisation view.
The affected endpoint returned fields including:
- organisation ID;
- UUID;
- name.
When Security.hideorganisationindexfromusers was enabled, normal organisation enumeration was restricted, but the dashboard picker still queried all organisations. This allowed authenticated users to discover organisations that should have remained hidden from them.
The fix calls Organisation::createConditions($this->Auth->user()) and appends the resulting ACL conditions to the picker query. Ordinary users are thereby limited to organisations associated with events or proposals they can already see, plus their own organisation, while users with the appropriate sharing-group privilege retain broader visibility.
Version affected: ≤2.5.45
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MISPto a version that resolves this vulnerability.Fixed in 2.5.45 - Configuration
Ensure Security.hide_organisation_index_from_users is enabled; note that prior to the fix, this setting did not prevent the Dashboard organisation picker from querying all organisations.
MISP Security.hide_organisation_index_from_users = enabled - Compensating control
If the MISP fix (adding ACL conditions via Organisation::createConditions($this->Auth->user()) to the Dashboard organisation picker query) has not been applied yet, restrict dashboard access so that only users with the appropriate sharing-group privilege can view organisation metadata through the picker.
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated MISP user can exploit it by accessing the dashboard organisation picker. The issue is relevant where Security.hide_organisation_index_from_users is enabled, because the picker bypassed the organisation visibility restrictions intended by that setting.
What information could an unauthorized user discover?
The affected picker exposed organisation metadata including the organisation ID, UUID, and name. It could reveal organisations that were not otherwise visible through the normal organisation index or per-organisation view.
Are all users exposed to the same extent?
No. After the fix, ordinary users are limited to organisations associated with events or proposals they can already view, plus their own organisation. Users with the appropriate sharing-group privilege retain broader visibility.
How can I determine whether my instance is affected?
Instances running MISP version 2.5.45 or earlier are affected. The practical exposure condition is that Security.hide_organisation_index_from_users is enabled and authenticated users can use the dashboard organisation picker.
What should be done if immediate patching is not possible?
The provided data does not specify a workaround. Restrict access for users who do not need dashboard access or organisation visibility until the ACL conditions are applied to the picker query.