A vulnerability in the MISP dashboard widgets allowed an authenticated user to manipulate the fields option…

CVE-2026-10864 is an information-disclosure flaw in MISP dashboard widgets where an authenticated user can tamper with the widget fields option and influence which data fields are returned or rendered. The public description does not publish an authoritative affected version range or fixed version; the latest publicly visible upstream release I found before disclosure was MISP 2.5.38 on 2026-05-20, so treat currently deployed 2.5 builds as *potentially affected until proven otherwise* rather than assuming safety.

There is no vendor CVSS baseline, so this has to be scored from scratch. In practice this is not internet-scale pre-auth RCE; it is a post-auth, app-layer data exposure problem gated behind dashboard functionality, which pushes the rating down. What keeps it out of LOW is that MISP often holds partner, community, or cross-org threat intel, so even a field-selection bypass can disclose data that matters operationally.

Why this verdict

• Authenticated remote only: the first prerequisite is a valid MISP session, which implies prior compromise, insider access, or legitimate tenant access and sharply narrows exposure versus pre-auth flaws.
• Dashboard path is a niche surface: this is not a universal request path hit by every user or every automation workflow; it depends on widget configuration behavior and a widget type that consumes fields.
• Impact is disclosure, not takeover: based on the published description and CWE-200 mapping, this is about influencing returned fields, not achieving code execution, auth bypass, or direct privilege escalation.

Why not higher?

There is no public sign of KEV listing, active exploitation, wormability, or unauthenticated reachability. The attack chain also appears bounded to dashboard widget behavior rather than a core record-access primitive, which keeps the blast radius narrower than the data itself might suggest.

Why not lower?

Calling this LOW would understate the value of the data sitting behind MISP. In real environments, MISP often aggregates sensitive partner intel, embargoed context, and community-shared indicators; a field-selection bypass in that setting is more than harmless UI weirdness.

1. Restrict dashboard access — Limit dashboard and widget-configuration privileges to trusted analyst roles only, especially on multi-org or externally federated MISP instances. For a MEDIUM verdict there is no mitigation SLA, but this is still the best temporary control to apply during the normal change window while you validate exposure.
2. Log widget-setting changes — Capture and retain reverse-proxy or application logs for requests that modify user dashboard settings, then alert on unusual fields values, long field lists, or repeated dashboard reconfiguration by one account. This gives you at least some behavioral visibility before a vendor-fixed version is identified.
3. Constrain low-trust accounts — Remove dashboard customization rights from guest, partner, or low-trust analyst accounts if they do not need them. This shrinks the exploitable population without disrupting core event-sharing workflows.
4. Review shared-intel tenancy — Prioritize instances that host cross-organisation, partner, or community-shared data, because those are where a field-disclosure flaw hurts most. Use your normal change process; for MEDIUM there is no mitigation SLA and the focus is controlled remediation rather than emergency response.

Run this on the MISP application host as a user that can read the MISP installation directory; root is not required unless file permissions are locked down. Invoke it as bash verify-cve-2026-10864.sh /var/www/MISP and it will use a conservative heuristic: versions up to 2.5.38 with dashboard code present are flagged VULNERABLE, newer builds are UNKNOWN until upstream publishes a fixed version.

#!/usr/bin/env bash
# verify-cve-2026-10864.sh
# Heuristic exposure check for CVE-2026-10864 in MISP dashboard widgets.
# Usage: bash verify-cve-2026-10864.sh /var/www/MISP
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN, 3=usage/error

set -u

ROOT="${1:-}"
if [[ -z "$ROOT" || ! -d "$ROOT" ]]; then
  echo "UNKNOWN - usage: bash verify-cve-2026-10864.sh /path/to/MISP"
  exit 3
fi

normalize_ver() {
  local v="$1"
  v="${v#v}"
  v="${v#MISP }"
  v="${v%% *}"
  echo "$v"
}

get_version() {
  local root="$1"
  local v=""

  if command -v git >/dev/null 2>&1 && [[ -d "$root/.git" ]]; then
    v=$(git -C "$root" describe --tags --abbrev=0 2>/dev/null || true)
    if [[ -n "$v" ]]; then
      normalize_ver "$v"
      return 0
    fi
  fi

  for f in "$root/VERSION" "$root/VERSION.json" "$root/app/VERSION" "$root/app/VERSION.json"; do
    if [[ -f "$f" ]]; then
      v=$(grep -Eo 'v?[0-9]+\.[0-9]+\.[0-9]+' "$f" 2>/dev/null | head -n1 || true)
      if [[ -n "$v" ]]; then
        normalize_ver "$v"
        return 0
      fi
    fi
  done

  return 1
}

ver_lte() {
  # returns 0 if $1 <= $2
  [[ "$(printf '%s\n%s\n' "$1" "$2" | sort -V | head -n1)" == "$1" ]]
}

DASHBOARD_PRESENT="no"
if [[ -d "$ROOT/app/Lib/Dashboard" || -d "$ROOT/app/View/Elements/dashboard" || -d "$ROOT/app/View/Dashboards" ]]; then
  DASHBOARD_PRESENT="yes"
fi

VERSION=""
if VERSION=$(get_version "$ROOT"); then
  :
else
  echo "UNKNOWN - could not determine installed MISP version; dashboard_present=$DASHBOARD_PRESENT"
  exit 2
fi

if [[ "$DASHBOARD_PRESENT" != "yes" ]]; then
  echo "UNKNOWN - MISP version=$VERSION but dashboard code path not clearly present"
  exit 2
fi

# Public upstream release visibility reached 2.5.38 on 2026-05-20 in retrieved sources.
# No authoritative fixed version for CVE-2026-10864 was found during assessment.
CUTOFF="2.5.38"

if ver_lte "$VERSION" "$CUTOFF"; then
  echo "VULNERABLE - MISP version=$VERSION is at or below public pre-disclosure cutoff $CUTOFF and dashboard code is present"
  exit 1
fi

echo "UNKNOWN - MISP version=$VERSION is newer than $CUTOFF, but no authoritative fixed version was publicly identified for CVE-2026-10864"
exit 2

Sources

1. MISP core repository
2. MISP v2.5.38 release notes
3. MISP security advisories page
4. MISP OpenAPI documentation
5. MISP 2.4.171 release notes (dashboard rework context)
6. CISA Known Exploited Vulnerabilities catalog
7. FIRST EPSS API documentation
8. FIRST EPSS FAQ