{"id":"CVE-2026-86417","title":"Affected versions of MISP inconsistently enforced email-address visibility in DashboardsController::listTemplates().\n\n\nThe query always fetched User.email, while redaction happened only inside the non-REST rendering branch","summary":"Affected versions of MISP inconsistently enforced email-address visibility in DashboardsController::listTemplates().\n\n\nThe query always fetched User.email, while redaction happened only inside the non-REST rendering branch. As a result, …","severity":"medium","cvss":4.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cwe":["CWE-200","CWE-862"],"vendor":"misp-project","product":"misp","affected":["misp <= 2.5.45"],"published":"2026-09-07","updated":"2026-09-09","sourceUpdated":"2026-09-09T15:26:08.863","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-86417","references":[{"url":"https://github.com/MISP/MISP/commit/fd554c3bd.patch","label":"5a6e4751-2f3f-4070-9419-94fb35b644e8"}],"tags":["nvd","cve.org"],"epss":0.0027,"epssPercentile":0.17159,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-08T14:50:16.295581Z"},"scores":{"nvd":4.3,"cna":5.3},"ingestedAt":"2026-09-08T15:33:26.977Z","slug":"CVE-2026-86417","body":"## Overview\n\nAffected versions of MISP inconsistently enforced email-address visibility in DashboardsController::listTemplates().\n\n\nThe query always fetched User.email, while redaction happened only inside the non-REST rendering branch. As a result, the same authenticated user who saw redacted data in the normal HTML interface could request the REST/JSON representation and receive template owners’ email addresses without the intended privilege check.\n\n\nThe fix moves the decision to a centralized User::canSeeEmails() authorization helper. Email addresses are now fetched only when the requester is a site administrator or the instance explicitly enables Security.disclose_user_emails. The same helper is also reused by other dashboard widgets to keep email-disclosure policy consistent.\n\nVersion affected: ≤2.5.45\n\n## Affected\n\n- `misp <= 2.5.45`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":24,"depthScoreParts":{"impact":23.7,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":202131,"id":"CVE-2026-86417","ts":1789400063244,"field":"cvss","old":"5.3","new":"4.3"},{"seq":200858,"id":"CVE-2026-86417","ts":1789397617174,"field":"cvss","old":"4.3","new":"5.3"},{"seq":199551,"id":"CVE-2026-86417","ts":1789395529771,"field":"cvss","old":"5.3","new":"4.3"},{"seq":198796,"id":"CVE-2026-86417","ts":1789392244994,"field":"cvss","old":"4.3","new":"5.3"},{"seq":197129,"id":"CVE-2026-86417","ts":1789384293105,"field":"cvss","old":"5.3","new":"4.3"},{"seq":196403,"id":"CVE-2026-86417","ts":1789383756776,"field":"cvss","old":"4.3","new":"5.3"},{"seq":195307,"id":"CVE-2026-86417","ts":1789380574974,"field":"cvss","old":"5.3","new":"4.3"},{"seq":194258,"id":"CVE-2026-86417","ts":1789378783810,"field":"cvss","old":"4.3","new":"5.3"},{"seq":193045,"id":"CVE-2026-86417","ts":1789376516803,"field":"cvss","old":"5.3","new":"4.3"},{"seq":191832,"id":"CVE-2026-86417","ts":1789373631852,"field":"cvss","old":"4.3","new":"5.3"},{"seq":190617,"id":"CVE-2026-86417","ts":1789369476779,"field":"cvss","old":"5.3","new":"4.3"},{"seq":189404,"id":"CVE-2026-86417","ts":1789368429887,"field":"cvss","old":"4.3","new":"5.3"},{"seq":188187,"id":"CVE-2026-86417","ts":1789365231557,"field":"cvss","old":"5.3","new":"4.3"},{"seq":186974,"id":"CVE-2026-86417","ts":1789363472054,"field":"cvss","old":"4.3","new":"5.3"},{"seq":185760,"id":"CVE-2026-86417","ts":1789361229892,"field":"cvss","old":"5.3","new":"4.3"},{"seq":184547,"id":"CVE-2026-86417","ts":1789358364571,"field":"cvss","old":"4.3","new":"5.3"},{"seq":182797,"id":"CVE-2026-86417","ts":1789354317958,"field":"cvss","old":"5.3","new":"4.3"},{"seq":181590,"id":"CVE-2026-86417","ts":1789353318480,"field":"cvss","old":"4.3","new":"5.3"},{"seq":180383,"id":"CVE-2026-86417","ts":1789350285553,"field":"cvss","old":"5.3","new":"4.3"},{"seq":179176,"id":"CVE-2026-86417","ts":1789348293684,"field":"cvss","old":"4.3","new":"5.3"},{"seq":177969,"id":"CVE-2026-86417","ts":1789346370810,"field":"cvss","old":"5.3","new":"4.3"},{"seq":176762,"id":"CVE-2026-86417","ts":1789343185275,"field":"cvss","old":"4.3","new":"5.3"},{"seq":174879,"id":"CVE-2026-86417","ts":1789334876451,"field":"cvss","old":"5.3","new":"4.3"},{"seq":173674,"id":"CVE-2026-86417","ts":1789333701582,"field":"cvss","old":"4.3","new":"5.3"},{"seq":172488,"id":"CVE-2026-86417","ts":1789331093836,"field":"cvss","old":"5.3","new":"4.3"},{"seq":171302,"id":"CVE-2026-86417","ts":1789328781618,"field":"cvss","old":"4.3","new":"5.3"},{"seq":170097,"id":"CVE-2026-86417","ts":1789327197926,"field":"cvss","old":"5.3","new":"4.3"},{"seq":168892,"id":"CVE-2026-86417","ts":1789323840919,"field":"cvss","old":"4.3","new":"5.3"},{"seq":167687,"id":"CVE-2026-86417","ts":1789319703473,"field":"cvss","old":"5.3","new":"4.3"},{"seq":166482,"id":"CVE-2026-86417","ts":1789318776925,"field":"cvss","old":"4.3","new":"5.3"},{"seq":165277,"id":"CVE-2026-86417","ts":1789315794933,"field":"cvss","old":"5.3","new":"4.3"},{"seq":164072,"id":"CVE-2026-86417","ts":1789313635022,"field":"cvss","old":"4.3","new":"5.3"},{"seq":162867,"id":"CVE-2026-86417","ts":1789311904265,"field":"cvss","old":"5.3","new":"4.3"},{"seq":161662,"id":"CVE-2026-86417","ts":1789308733949,"field":"cvss","old":"4.3","new":"5.3"},{"seq":159775,"id":"CVE-2026-86417","ts":1789300471335,"field":"cvss","old":"5.3","new":"4.3"},{"seq":156764,"id":"CVE-2026-86417","ts":1789294756445,"field":"cvss","old":"4.3","new":"5.3"},{"seq":155559,"id":"CVE-2026-86417","ts":1789292968706,"field":"cvss","old":"5.3","new":"4.3"},{"seq":154354,"id":"CVE-2026-86417","ts":1789289798340,"field":"cvss","old":"4.3","new":"5.3"},{"seq":151605,"id":"CVE-2026-86417","ts":1789277630589,"field":"cvss","old":"5.3","new":"4.3"},{"seq":150566,"id":"CVE-2026-86417","ts":1789276253343,"field":"cvss","old":"4.3","new":"5.3"},{"seq":149533,"id":"CVE-2026-86417","ts":1789273825479,"field":"cvss","old":"5.3","new":"4.3"},{"seq":148500,"id":"CVE-2026-86417","ts":1789271349613,"field":"cvss","old":"4.3","new":"5.3"},{"seq":146531,"id":"CVE-2026-86417","ts":1789269398788,"field":"cvss","old":"5.3","new":"4.3"},{"seq":145336,"id":"CVE-2026-86417","ts":1789266340999,"field":"cvss","old":"4.3","new":"5.3"},{"seq":144240,"id":"CVE-2026-86417","ts":1789262617463,"field":"cvss","old":"5.3","new":"4.3"},{"seq":143144,"id":"CVE-2026-86417","ts":1789261534182,"field":"cvss","old":"4.3","new":"5.3"},{"seq":141975,"id":"CVE-2026-86417","ts":1789258832623,"field":"cvss","old":"5.3","new":"4.3"},{"seq":140816,"id":"CVE-2026-86417","ts":1789256727870,"field":"cvss","old":"4.3","new":"5.3"},{"seq":139618,"id":"CVE-2026-86417","ts":1789254832809,"field":"cvss","old":"5.3","new":"4.3"},{"seq":138420,"id":"CVE-2026-86417","ts":1789251934953,"field":"cvss","old":"4.3","new":"5.3"}]}