Executive brief
A vulnerability in the MISP threat intelligence platform could allow a standard user to view sensitive information they are not authorized to see. By manipulating dashboard widgets, an attacker could bypass privacy settings to access restricted data such as user email addresses and organizational metadata. This could lead to unauthorized disclosure of contact information and internal organizational details.
Technical details
A vulnerability exists in the MISP dashboard's 'New Users' and 'New Organisations' widgets due to improper handling of field filtering and redaction (CWE-200). An authenticated attacker can manipulate the 'fields' option in a request; if the resulting field set becomes empty after validation, the underlying database query may fall back to returning all model fields, including those restricted by configuration. This allows low-privileged users to disclose sensitive data such as user email addresses even when disclosure is disabled. The issue was addressed in commit 8722fda by ensuring the allowed field list is safely constructed and restricted fields are removed before processing user input.
Affected products
- MISP Project MISP Prior to commit 8722fda
Timeline
- 2026-06-04: disclosed
- 2026-06-04: advisory