User Email Disclosure in MISP ct-transmute Affected by Authentication Flaw

CVE-2026-72760

What is CVE-2026-72760?

An authentication flaw in MISP's cti-transmute reveals users' email addresses via the account following-list endpoint. When an authenticated user follows another account, the API response includes the followed user's email, among other details, making it possible for an attacker to exploit this feature. Since the email is not needed for this functionality and is absent in other related user lists, an attacker could systematically follow users to harvest email addresses. The issue has been addressed by removing the email field from the API response to enhance user privacy.

References