CVE-2026-86441: MISP Dashboard Organisation Widgets Bypass Organisation-Index Restrictions and Expose Hidden Organisation Data
Affected versions of MISP contain inconsistent authorization checks across dashboard widgets that display organisation information.
Several organisation-related widgets did not honor Security.hideorganisationindexfromusers. As a result, authenticated users without the permsharinggroup permission could enumerate organisations even though the normal organisation index was intentionally hidden from them.
The affected widgets included paths that:
returned organisation names and identifiers;
could expose additional organisation database fields through JSON export because unrestricted find('all') queries fetched full rows;
accepted limit=0 or negative values in a way that could effectively remove the result limit and return the entire organisation table.
A related organisation-contributor leaderboard also ignored the same visibility setting. Its handler counted Event.orgcid across the entire event table and mapped those IDs to organisation names, revealing every organisation with events regardless of whether the caller could see any of those events. The fix withdraws this widget entirely for users who lack organisation-index visibility.
Version affected: ≤2.5.45
Affected Software
Event History
Frequently Asked Questions
Which users are exposed to this issue?
Authenticated users who lack the perm_sharing_group permission are affected when Security.hide_organisation_index_from_users is enabled. Those users could still enumerate organisations through affected dashboard widgets despite being blocked from the normal organisation index.
What information could the affected widgets reveal?
They could reveal organisation names and identifiers. JSON export paths could expose additional organisation database fields because unrestricted queries retrieved full organisation rows, and the contributor leaderboard could reveal names of organisations associated with events the caller could not view.
Could an attacker retrieve all organisations at once?
Potentially. Supplying limit=0 or a negative limit could effectively remove the result limit and return the full organisation table through affected widget paths.
What mitigation is available if the affected version cannot be updated immediately?
The data identifies the affected dashboard widgets as the exposure path, particularly for users who should not have organisation-index visibility. Restricting access to those widgets for such users mitigates the described bypass; the fix removes the widget entirely for users lacking organisation-index visibility.
How can administrators assess whether their deployment is affected?
Deployments running MISP version 2.5.45 or earlier are affected. Risk is present when Security.hide_organisation_index_from_users is enabled and authenticated users without perm_sharing_group can access organisation-related dashboard widgets or the organisation-contributor leaderboard.