CVE-2026-86418: MISP Dashboard Organisation Picker Exposes Hidden Organisation Metadata to Unauthorized Users
Affected versions of MISP expose organisation metadata through the dashboard organisation picker without applying the same visibility restrictions enforced by the normal organisation index and per-organisation view.
The affected endpoint returned fields including:
organisation ID;
UUID;
name.
When Security.hideorganisationindexfromusers was enabled, normal organisation enumeration was restricted, but the dashboard picker still queried all organisations. This allowed authenticated users to discover organisations that should have remained hidden from them.
The fix calls Organisation::createConditions($this->Auth->user()) and appends the resulting ACL conditions to the picker query. Ordinary users are thereby limited to organisations associated with events or proposals they can already see, plus their own organisation, while users with the appropriate sharing-group privilege retain broader visibility.
Version affected: ≤2.5.45
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MISPto a version that resolves this vulnerability.Fixed in 2.5.45 - Configuration
Ensure Security.hide_organisation_index_from_users is enabled; otherwise normal organisation enumeration is not restricted. (Material states this option restricted normal organisation enumeration, but the dashboard picker still queried all organisations.)
MISP Security.hide_organisation_index_from_users = enabled - Compensating control
After applying the fix, confirm the dashboard organisation picker query uses the same ACL/visibility restrictions as the normal organisation index and per-organisation view by enforcing the ACL conditions returned by Organisation::createConditions($this->Auth->user()) in the picker query.
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated MISP user can exploit it by accessing the dashboard organisation picker. The issue is relevant where Security.hide_organisation_index_from_users is enabled, because the picker bypassed the organisation visibility restrictions intended by that setting.
What information could an unauthorized user discover?
The affected picker exposed organisation metadata including the organisation ID, UUID, and name. It could reveal organisations that were not otherwise visible through the normal organisation index or per-organisation view.
Are all users exposed to the same extent?
No. After the fix, ordinary users are limited to organisations associated with events or proposals they can already view, plus their own organisation. Users with the appropriate sharing-group privilege retain broader visibility.
How can I determine whether my instance is affected?
Instances running MISP version 2.5.45 or earlier are affected. The practical exposure condition is that Security.hide_organisation_index_from_users is enabled and authenticated users can use the dashboard organisation picker.
What should be done if immediate patching is not possible?
The provided data does not specify a workaround. Restrict access for users who do not need dashboard access or organisation visibility until the ACL conditions are applied to the picker query.