CVE-2026-86418 MISP CVE debrief

Who should care

MISP administrators and users who rely on organisation visibility restrictions to protect sensitive information. These stakeholders should review and update their systems to version > 2.5.45 and restrict access to the dashboard organisation picker to prevent potential misuse of organisation metadata for reconnaissance or lateral movement.

Why it matters

CVE-2026-86418 allows authenticated users to discover organisations that should be hidden from them through the dashboard organisation picker in MISP versions ≤2.5.45. This may lead to potential misuse of organisation metadata for reconnaissance or lateral movement. MISP administrators and users who rely on organisation visibility restrictions should review and update their systems to version > 2.5.45 and restrict access to the dashboard organisation picker.

• Authenticated users may discover hidden organisations via the dashboard organisation picker
• Potential misuse of organisation metadata for reconnaissance or lateral movement

Technical summary

Affected versions of MISP expose organisation metadata through the dashboard organisation picker without applying the same visibility restrictions enforced by the normal organisation index and per-organisation view. The fix calls Organisation::createConditions($this->Auth->user()) and appends the resulting ACL conditions to the picker query. Ordinary users are thereby limited to organisations associated with events or proposals they can already see, plus their own organisation, while users with the appropriate sharing-group privilege retain broader visibility. This vulnerability allows authenticated users to discover organisations that should be hidden from them.

Defensive priority

Authenticated users may discover hidden organisations via the dashboard organisation picker

Recommended defensive actions

• Review and update MISP to version > 2.5.45
• Restrict access to the dashboard organisation picker for authenticated users
• Monitor for potential misuse of the dashboard organisation picker
• Confirm whether affected MISP deployments exist in managed environments and assign an owner for follow-up.
• Review compensating controls for exposed MISP systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed MISP assets that need extra review.
• Track exceptions, retest remediated MISP assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in MISP versions ≤2.5.45, where authenticated users can discover organisations that should be hidden from them through the dashboard organisation picker.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.