CVE-2026-10864: MISP Dashboard Widget Field Filtering Bypass (Medium)

Technical summary

CVE-2026-10864 involves improper field filtering and redaction logic in MISP dashboard widgets. When a user supplies a crafted field selection that becomes empty after validation or redaction, the application fails to enforce a safe fallback, instead returning unintended model fields. The root cause is the order of operations: field filtering and redaction occur after user-supplied field selection is processed, creating a window where restricted fields (like user.email) can be accessed by non-admin users even when administratively disabled. The patch reorders this logic to build the allowed field list first, remove restricted fields before processing user input, and enforce permitted defaults for empty selections.

Business impact

Organizations running MISP for threat intelligence and incident coordination face unauthorized disclosure of user contact information and organizational metadata. This undermines access control policies and privacy controls, potentially enabling social engineering campaigns if attacker emails are leaked, or exposing organizational structure to threat actors. Low-privileged users (analysts, junior staff) can access data intended only for administrators, violating principle-of-least-privilege and complicating audit trails. For compliance-sensitive environments (healthcare, finance), unintended email disclosure may trigger notification obligations.

Affected systems

MISP (Malware Information Sharing Platform) dashboard functionality is affected. The vulnerability is present in the New Users and New Organisations widgets, requiring an authenticated user account to exploit. Non-admin users with basic dashboard access are the primary attack vector. Versions prior to the patch release are vulnerable; check the MISP project advisory for exact version cutoffs.

Exploitability

Exploitability is moderate and practical. An attacker must have valid MISP credentials (low barrier—many organizations grant broad analyst access), but requires no administrative privileges or additional interaction. The attack is entirely client-side manipulation of widget parameters and leaves no obvious audit trail if logging is not verbose. However, exploitation is limited to authenticated sessions and does not grant code execution or system-level access, earning the CVSS 3.1 score of 4.3 (Medium severity).

Remediation

Update MISP to a patched version that enforces safe field filtering logic. Verify the patch version and release notes from the MISP project advisory. After patching, test dashboard widgets to confirm email and organization field restrictions are respected. Additionally, audit dashboard access controls: restrict access to dashboards to users who genuinely need it, and review any previous dashboard logs if available to detect historical exploitation attempts.

Patch guidance

Apply the latest MISP patch addressing CVE-2026-10864 as released by the MISP project. Consult the official MISP advisory for specific patch versions and deployment instructions. Given the low technical barrier to exploit (only requires authentication), prioritize this patch over optional feature updates. Test the patch in a staging environment to verify dashboard widget behavior, particularly the New Users and New Organisations widgets, before production rollout.

Detection guidance

Monitor for suspicious dashboard widget usage patterns: repeated requests to the New Users or New Organisations widgets with unusual or rapidly changing field parameters, particularly from non-admin accounts. If verbose logging is available, examine dashboard widget API calls for field manipulation attempts. Review audit logs for unauthorized access to email fields or organization fields that should be restricted by policy. Correlate dashboard access with subsequent social engineering or reconnaissance activity targeting leaked email addresses.

Why prioritize this

While the CVSS score is moderate (4.3), the impact is material for organizations using MISP as a central threat intelligence hub. The vulnerability directly undermines access control policy and can leak contact information. However, it requires authentication, making it lower priority than unauthenticated exploits. Prioritize patching if you have restrictive data policies (e.g., user emails disabled by design) or if MISP is shared across security teams with varying privilege levels.

Risk score, explained

CVSS 3.1 score of 4.3 (Medium) reflects the requirement for authentication (PR:L), absence of integrity or availability impact (I:N/A:N), and low confidentiality loss (C:L) from a single user's perspective. However, the ease of exploitation, breadth of affected widgets, and potential for chained social engineering elevate practical risk beyond the base score. In multi-tenant or cross-team MISP deployments, the risk is higher.

Frequently asked questions