CVE-2026-91851

Affected versions of MISP incorrectly filter dashboard templates that are restricted to a specific permission flag. DashboardsController::listTemplates allowed a template when either: - its restricttopermissionflag matched one of the current user’s permission flags, or - restricttopermissionflag...

CVE-2026-91851 MISP Dashboard Template ACL Bypass Due to VARCHAR-to-Integer Type Coercion in Permission Flag Comparison

Affected versions of MISP incorrectly filter dashboard templates that are restricted to a specific permission flag. DashboardsController::listTemplates allowed a template when either: - its restricttopermissionflag matched one of the current user’s permission flags, or - restricttopermissionflag...

PT-2026-91905

Affected versions of MISP incorrectly filter dashboard templates that are restricted to a specific permission flag. DashboardsController::listTemplates allowed a template when either: - its restrict to permission flag matched one of the current user’s permission flags, or - restrict to permission...

CVE-2026-91851: Incorrect Authorization

Affected versions of MISP incorrectly filter dashboard templates that are restricted to a specific permission flag. DashboardsController::listTemplates allowed a template when either: - its restricttopermissionflag matched one of the current user’s permission flags, or - restricttopermissionflag...

CVE-2026-86417: Exposure of Sensitive Information to an Unauthorized Actor

Affected versions of MISP inconsistently enforced email-address visibility in DashboardsController::listTemplates. The query always fetched User.email, while redaction happened only inside the non-REST rendering branch. As a result, the same authenticated user who saw redacted data in the normal...

CVE-2025-30675: Exposure of Sensitive Information to an Unauthorized Actor

In Apache CloudStack, a flaw in access control affects the listTemplates and listIsos APIs. A malicious Domain Admin or Resource Admin can exploit this issue by intentionally specifying the 'domainid' parameter along with the 'filter=self' or 'filter=selfexecutable' values. This allows the attack...