CVE-2026-86441

Affected versions of MISP contain inconsistent authorization checks across dashboard widgets that display organisation information. Several organisation-related widgets did not honor Security.hide_organisation_index_from_users. As a result, authenticated users without the perm_sharing_group permission could enumerate organisations even though the normal organisation index was intentionally hidden from them. The affected widgets included paths that: * returned organisation names and identifiers; * could expose additional organisation database fields through JSON export because unrestricted find('all') queries fetched full rows; * accepted limit=0 or negative values in a way that could effectively remove the result limit and return the entire organisation table. A related organisation-contributor leaderboard also ignored the same visibility setting. Its handler counted Event.orgc_id across the entire event table and mapped those IDs to organisation names, revealing every organisation with events regardless of whether the caller could see any of those events. The fix withdraws this widget entirely for users who lack organisation-index visibility. Version affected: ≤2.5.45

• CWE-200
• CWE-862

• https://github.com/MISP/MISP/commit/5e333a159.patch
• https://github.com/MISP/MISP/commit/67892d90e

Published

Sep 7, 2026

Last Modified

Sep 8, 2026

Status

Undergoing Analysis

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-86436Lara Dashboard before 1.3.2 fails to authorize access to the…5.4
• CVE-2026-86437Lara Dashboard before 1.3.2 authorizes the POST /admin/setti…7.2
• CVE-2026-86438Lara Dashboard before 1.3.2 fails to authorize the Marketpla…7.2
• CVE-2026-86439knowns versions before 0.30.0 fail to validate filesystem pa…8.8
• CVE-2026-8644IBM WebSphere Application Server 9.0, and 8.5 is vulnerable …9.1
• CVE-2026-86440Affected versions of MISP insufficiently validate URLs used …5.1
• CVE-2026-86451Affected versions of MISP allow authenticated users to retri…5.3
• CVE-2026-86452Affected versions of MISP permit unauthenticated or weakly c…8.7
• CVE-2026-8646IBM WebSphere Application Server 9.0 and 8.5 and IBM WebSphe…9.1
• CVE-2026-86464In the current development version of Eclipse aeriOS, for wh…9.9
• CVE-2026-86469A flaw was found in GLib2. When g_file_replace() is used wit…5.3
• CVE-2026-8647Crypt::ScryptKDF versions through 0.010 for Perl uses insecu…4.8