CVE-2026-10864

Name of the Vulnerable Software and Affected Versions MISP (affected versions not specified)

Description An issue in the dashboard widgets allows an authenticated user to manipulate the fields option to influence the data returned by the New Users and New Organisations widgets. When a requested field set becomes empty after validation or redaction, the underlying query may fall back to returning unintended model fields. This can enable a non-site-admin user to disclose restricted metadata, such as user e-mail addresses, even if e-mail disclosure is disabled in the configuration.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.