What is GHSA-82w9-ppqv-p5c6?

GHSA-82w9-ppqv-p5c6 is a security advisory published by GitHub Security Advisories with Medium severity. Affected versions of MISP inconsistently enforced email-address visibility in...

Which CVE IDs does GHSA-82w9-ppqv-p5c6 cover?

GHSA-82w9-ppqv-p5c6 covers the following CVE IDs: CVE-2026-86417. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-82w9-ppqv-p5c6?

GHSA-82w9-ppqv-p5c6 has a CVSS v3 base score of 4.3, published by GitHub Security Advisories.

GHSA-82w9-ppqv-p5c6MediumCVSS 4.3

Affected versions of MISP inconsistently enforced email-address visibility in...

Vendor

GitHub Security Advisories

Published

September 7, 2026

Last Modified

September 9, 2026

🔗 CVE IDs covered (1)

CVE-2026-86417 →

📋 Description

Affected versions of MISP inconsistently enforced email-address visibility in DashboardsController::listTemplates().

The query always fetched User.email, while redaction happened only inside the non-REST rendering branch. As a result, the same authenticated user who saw redacted data in the normal HTML interface could request the REST/JSON representation and receive template owners’ email addresses without the intended privilege check.

The fix moves the decision to a centralized User::canSeeEmails() authorization helper. Email addresses are now fetched only when the requester is a site administrator or the instance explicitly enables Security.disclose_user_emails. The same helper is also reused by other dashboard widgets to keep email-disclosure policy consistent.

Version affected: ≤2.5.45

🔗 CVE IDs covered (1)

📋 Description

🔗 References (3)