Authorization Flaw in MISP Dashboard Widgets by MISP

CVE-2026-86441

What is CVE-2026-86441?

Multiple authorization inconsistencies were found within MISP's dashboard widgets, where certain widgets failed to enforce proper security settings. Specifically, these widgets allowed authenticated users, lacking the appropriate permissions, to view sensitive organization information that should be protected. The flawed authorization checks not only permitted the enumeration of organization names and IDs but also unintentionally exposed additional organizational data through unregulated database queries. Furthermore, a leaderboard feature was similarly affected, revealing organizations associated with events without proper visibility controls in place. These vulnerabilities highlight the need for robust authorization mechanisms to ensure sensitive data remains adequately protected.

References