Inconsistent Email Address Visibility in MISP Dashboards by MISP Project

CVE-2026-86417

What is CVE-2026-86417?

The vulnerability in MISP arises from inconsistent enforcement of email address visibility within the application. Specifically, when users access dashboards, their email addresses were exposed in REST/JSON representations despite being redacted in the standard HTML interface. This oversight allowed authenticated users to retrieve sensitive information without proper privilege checks. The solution involves the introduction of a centralized authorization helper, User::canSeeEmails(), which ensures that email addresses are disclosed only to site administrators or when explicitly permitted by the instance’s security settings. This fix enhances the consistency of email disclosure policies across various components in the MISP platform.

References