EUVD-2026-72374
GHSA-6x2c-442p-85rw
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H because exploitation requires Security.hide_organisation_index_from_users to be enabled (attacker-independent prerequisite); PR:L for authenticated access; C:L for read-only org-metadata disclosure only.
Primary rating from Vendor (CIRCL).
CVSS VectorVendor: CIRCL
Lifecycle Timeline
3DescriptionCVE.org
Affected versions of MISP contain inconsistent authorization checks across dashboard widgets that display organisation information.
Several organisation-related widgets did not honor Security.hide_organisation_index_from_users. As a result, authenticated users without the perm_sharing_group permission could enumerate organisations even though the normal organisation index was intentionally hidden from them.
The affected widgets included paths that:
* returned organisation names and identifiers;
* could expose additional organisation database fields through JSON export because unrestricted find('all') queries fetched full rows;
* accepted limit=0 or negative values in a way that could effectively remove the result limit and return the entire organisation table.
A related organisation-contributor leaderboard also ignored the same visibility setting. Its handler counted Event.orgc_id across the entire event table and mapped those IDs to organisation names, revealing every organisation with events regardless of whether the caller could see any of those events. The fix withdraws this widget entirely for users who lack organisation-index visibility.
Version affected: ≤2.5.45
AnalysisAI
Authenticated MISP users can enumerate the hidden organisation directory in deployments running version ≤2.5.45 where Security.hide_organisation_index_from_users is enabled, because multiple dashboard widgets failed to enforce the same authorization check that guards the standard /organisations/index endpoint. Three compounding weaknesses escalate the exposure beyond simple enumeration: missing checkPermissions() in NewOrgsWidget and OrgsContributorsGeneric allows any authenticated user to bypass the intended restriction; unrestricted find('all') database queries returned full organisation table rows including contacts and metadata through the JSON export code path; and a limit parameter flaw (limit=0 or negative values exploiting CakePHP DboSource behavior) effectively removed result pagination, potentially dumping the entire organisation table. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) a valid MISP user account of any role - no special privileges beyond basic authentication (PR:L); (2) the target MISP instance must have Security.hide_organisation_index_from_users explicitly set to true in its configuration, which is a deliberate administrator action to restrict org visibility - this is the configuration the vulnerability bypasses, and deployments that have not enabled it are not affected; (3) access to the MISP dashboard widget interface (standard user capability). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 2.3 (AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N) accurately reflects real-world risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade MISP to the first release after 2.5.45 that incorporates commits 67892d90e and 5e333a159 (exact patched version number not independently confirmed from available data - verify at https://github.com/MISP/MISP/releases). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
An issue was discovered in MISP 2.4.9x before 2.4.99. Rated high severity (CVSS 8.8), this vulnerability is remotely exp
An issue was discovered in MISP before 2.4.158. Rated critical severity (CVSS 9.8), this vulnerability is remotely explo
app/Controller/Component/IndexFilterComponent.php in MISP before 2.4.167 mishandles ordered_url_params and additional_de
SQL injection in MISP threat intelligence platform versions prior to 2.5.37 allows remote unauthenticated attackers to m
An issue was discovered in MISP before 2.4.158. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitab
MISP 2.4.172 mishandles different certificate file extensions in server sync. Rated high severity (CVSS 7.5), this vulne
In MISP before 2.4.148, app/Lib/Export/OpendataExport.php mishandles parameter data that is used in a shell_exec call. R
An issue was discovered in app/Controller/UsersController.php in MISP 2.4.92. Rated critical severity (CVSS 9.8), this v
An issue was discovered in MISP 2.4.128. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable,
MISP before 2.4.135 lacks an ACL check, related to app/Controller/GalaxyElementsController.php and app/Model/GalaxyEleme
app/View/Elements/genericElements/IndexTable/Fields/generic_field.ctp in MISP 2.4.144 does not sanitize certain data rel
MISP 2.4.148, in certain configurations, allows SQL injection via the app/Model/Log.php $conditions['org'] value. Rated
Same weakness CWE-862 – Missing Authorization
View allShare
External POC / Exploit Code
Leaving vuln.today