Vulnerability in MISP Dashboard Widgets Allows Data Disclosure

CVE-2026-10864

What is CVE-2026-10864?

A vulnerability in the MISP dashboard widgets permits authenticated low-privileged users to manipulate field options, potentially allowing unintended disclosure of sensitive user and organization metadata. This affects the New Users and New Organisations widgets, where crafted field selections can lead to the return of restricted information like user email addresses, even if such disclosures are disabled in the configuration. The flaw arises when field filtering and redaction are improperly applied, resulting in an empty field list that causes the system to revert to default fields that may include sensitive data. The security patch reinforces field selection safety by adequately removing restricted fields prior to processing user inputs.

References