https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 04:28:27 +0000 https://cve.radiocsirt.org/vuln/cve-2026-86417 <p><strong>Affected:</strong> MISP</p> <p>Affected versions of MISP inconsistently enforced email-address visibility in DashboardsController::listTemplates().</p> <p>The query always fetched User.email, while redaction happened only inside the non-REST rendering branch. As a result, the same authenticated user who saw redacted data in the normal HTML interface could request the REST/JSON representation and receive template owners’ email addresses without the intended privilege check.</p> <p>The fix moves the decision to a centralized User::canSeeEmails() authorization helper. Email addresses are now fetched only when the requester is a site administrator or the instance explicitly enables Security.disclose_user_emails. The same helper is also reused by other dashboard widgets to keep email-disclosure policy consistent.</p> <p>Version affected: ≤2.5.45</p> <p><strong>Affected:</strong> MISP</p> <p>Affected versions of MISP inconsistently enforced email-address visibility in DashboardsController::listTemplates().</p> <p>The query always fetched User.email, while redaction happened only inside the non-REST rendering branch. As a result, the same authenticated user who saw redacted data in the normal HTML interface could request the REST/JSON representation and receive template owners’ email addresses without the intended privilege check.</p> <p>The fix moves the decision to a centralized User::canSeeEmails() authorization helper. Email addresses are now fetched only when the requester is a site administrator or the instance explicitly enables Security.disclose_user_emails. The same helper is also reused by other dashboard widgets to keep email-disclosure policy consistent.</p> <p>Version affected: ≤2.5.45</p> https://cve.radiocsirt.org/vuln/cve-2026-86417