Is there a patch available for CVE-2026-10864?

Yes, a patch is available for CVE-2026-10864. Update the affected software to the latest version immediately.

MISP CVE-2026-10864

Q: What is the CVSS score of CVE-2026-10864?

CVE-2026-10864 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-34266 MEDIUM

Information Exposure (CWE-200)

2026-06-04 CIRCL

GHSA-fpxh-9966-h5g3

Information Disclosure Misp

5.3

CVSS 4.0 · Vendor: CIRCL

Severity by source

Vendor (CIRCL) PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (CIRCL) · only source for this CVE.

CVSS VectorVendor: CIRCL

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jun 04, 2026 - 16:53 vuln.today

Analysis Generated

Jun 04, 2026 - 16:53 vuln.today

CVSS changed

Jun 04, 2026 - 15:22 NVD

5.3 (MEDIUM)

CVE Published

Jun 04, 2026 - 13:54 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

A vulnerability in the MISP dashboard widgets allowed an authenticated user to manipulate the fields option and influence which fields were returned by the New Users and New Organisations widgets. In some cases, requesting a field set that became empty after validation or redaction could cause the underlying query to fall back to returning unintended model fields.

For the New Users widget, this could allow a non-site-admin user to obtain user e-mail addresses even when user e-mail disclosure was disabled by configuration. For the New Organisations widget, crafted field selection could similarly result in unintended organisation fields being included in the dashboard response.

The issue was caused by applying field filtering and redaction in a way that could leave the selected field list empty. The patch ensures that the allowed field list is built safely, that restricted fields such as user e-mail addresses are removed before user-supplied field selection is processed, and that an empty field selection falls back only to the permitted default fields.

Impact: An authenticated low-privileged user with access to the affected dashboard widgets may be able to disclose restricted user or organisation metadata, including user e-mail addresses depending on configuration.

AnalysisAI

Authenticated low-privileged users in MISP versions up to and including 2.5.38 can manipulate the fields parameter of the New Users and New Organisations dashboard widgets to bypass server-side field redaction and retrieve restricted metadata - including user email addresses even when email disclosure is explicitly disabled via Security.disclose_user_emails configuration. The root cause is an order-of-operations flaw: in the original code, the email redaction check was applied after the fallback logic that repopulated the field list, meaning a crafted empty field selection after validation could trigger a return of unredacted model fields. No public exploit has been identified at time of analysis, and SSVC rates exploitation status as none; however, the low attack complexity and absence of user interaction requirements mean any authenticated user can reliably reproduce the condition.

Technical ContextAI

MISP is an open-source threat intelligence sharing platform maintained by CIRCL (Computer Incident Response Center Luxembourg). The affected components are two PHP dashboard widget handlers - NewUsersWidget.php and NewOrgsWidget.php - within the app/Lib/Dashboard directory. Both widgets accept user-supplied field selection options and are expected to redact sensitive fields (such as user email addresses) based on the requesting user's role and the Security.disclose_user_emails configuration setting. The defect is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). Specifically, the original code applied email redaction via unset($fields['email']) only after the user-supplied field list had already been validated and potentially collapsed to empty - at which point the fallback logic repopulated $fields from the full $field_options array, which had not yet had the email field stripped. The commit diff at 8722fda035b5b622de387ae1dd0159d71ff1e22e confirms the fix: the email unset is now applied to $field_options before any user-supplied selection is processed, ensuring the restricted field cannot re-enter scope via the fallback path. The affected CPE is cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:* covering all versions through 2.5.38.

RemediationAI

Upstream fix is available via GitHub commit 8722fda035b5b622de387ae1dd0159d71ff1e22e (https://github.com/MISP/MISP/commit/8722fda035b5b622de387ae1dd0159d71ff1e22e); a released tagged version beyond 2.5.38 is the expected vehicle, but the exact patched release version is not independently confirmed from available source data - operators should verify the current MISP release on the official repository. As an immediate compensating control, administrators can restrict access to the MISP dashboard entirely for non-trusted users, or temporarily disable the New Users and New Organisations widgets for non-site-admin roles - note this trades dashboard visibility for all affected users. Additionally, enabling Security.disclose_user_emails eliminates the email-disclosure vector specifically (though the organisation field leak path may remain); this has the trade-off of broadening email visibility to all authenticated users. There is no workaround that preserves full widget functionality while blocking the attack without applying the patch.