PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-10864 misp CVE debrief

A vulnerability in the MISP dashboard widgets allowed an authenticated user to manipulate the fields option and influence which fields were returned by the New Users and New Organisations widgets. This could lead to disclosure of restricted user or organisation metadata, including user e-mail addresses depending on configuration.

Vendor
misp
Product
Unknown
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-04
Original CVE updated
2026-07-22
Advisory published
2026-06-04
Advisory updated
2026-07-22

Who should care

Authenticated low-privileged users with access to the affected dashboard widgets may be able to disclose restricted user or organisation metadata.

Technical summary

The issue was caused by applying field filtering and redaction in a way that could leave the selected field list empty. The patch ensures that the allowed field list is built safely, that restricted fields such as user e-mail addresses are removed before user-supplied field selection is processed, and that an empty field selection falls back only to the permitted default fields.

Defensive priority

MEDIUM

Recommended defensive actions

  • Apply the patch: [ref-4](https://github.com/MISP/MISP/commit/8722fda035b5b622de387ae1dd0159d71ff1e22e)

Evidence notes

CVE-2026-10864 has a CVSS score of 5.3 and is classified as MEDIUM severity.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-10864 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-10864

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-10864 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-10864

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://github.com/MISP/MISP/commit/8722fda035b5b622de387ae1dd0159d71ff1e22e

    5a6e4751-2f3f-4070-9419-94fb35b644e8 - Patch

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.