CVE-2026-86417

Affected versions of MISP inconsistently enforced email-address visibility in DashboardsController::listTemplates(). The query always fetched User.email, while redaction happened only inside the non-REST rendering branch. As a result, the same authenticated user who saw redacted data in the normal HTML interface could request the REST/JSON representation and receive template owners’ email addresses without the intended privilege check. The fix moves the decision to a centralized User::canSeeEmails() authorization helper. Email addresses are now fetched only when the requester is a site administrator or the instance explicitly enables Security.disclose_user_emails. The same helper is also reused by other dashboard widgets to keep email-disclosure policy consistent. Version affected: ≤2.5.45

• CWE-200
• CWE-862

• https://github.com/MISP/MISP/commit/fd554c3bd.patch

Published

Sep 7, 2026

Last Modified

Sep 8, 2026

Status

Undergoing Analysis

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-86351Affected versions of MISP validate the user-configurable hom…5.1
• CVE-2026-8636IBM Datacap 9.1.7, 9.1.8, and 9.1.9 and IBM Datacap Navigato…7.5
• CVE-2026-8637A potential uncontrolled search path vulnerability was repor…8.5
• CVE-2026-86404EAP's Artemis deserialization configuration permits deserial…8.8
• CVE-2026-86408Affected versions of MISP do not enforce parent-event visibi…7.1
• CVE-2026-86416ILIAS versions before 9.23, 10.11, and 11.4 contain an autho…5.4
• CVE-2026-86418Affected versions of MISP expose organisation metadata throu…2.3
• CVE-2026-86419Affected versions of MISP contain insufficient validation of…7
• CVE-2026-86420ImageMagick before 7.1.2-30 and 6.9.13-55 fails to properly …3.7
• CVE-2026-86421ImageMagick before 7.1.2-30 and 6.9.13-55 contains a memory …3.7
• CVE-2026-86422ImageMagick before 7.1.2-30 contains a time-of-check-time-of…3.3
• CVE-2026-86423ImageMagick before 7.1.2-30 and 6.9.x before 6.9.13-55 conta…3.3