CyberRota Analysis
AI-GeneratedMISP versions up to 2.5.45 are vulnerable due to inconsistent enforcement of email address visibility, allowing authenticated users to access template owners' email addresses through the REST/JSON interface despite redaction in the HTML view. This could lead to unauthorized exposure of sensitive user information, particularly affecting user privacy and data security. Organizations using MISP, especially those handling sensitive data, should prioritize applying the fix to mitigate potential privacy breaches.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Affected versions of MISP inconsistently enforced email-address visibility in DashboardsController::listTemplates(). The query always fetched User.email, while redaction happened only inside the non-REST rendering branch. As a result, the same authenticated user who saw redacted data in the normal HTML interface could request the REST/JSON representation and receive template owners’ email addresses without the intended privilege check. The fix moves the decision to a centralized User::canSeeEmails() authorization helper. Email addresses are now fetched only when the requester is a site administrator or the instance explicitly enables Security.disclose_user_emails. The same helper is also reused by other dashboard widgets to keep email-disclosure policy consistent. Version affected: ≤2.5.45
Related CVEs
Other vulnerabilities affecting the same vendor(s)