CVE-2026-72760
Received Received - Intake

Information Disclosure in MISP cti-transmute

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: 5a6e4751-2f3f-4070-9419-94fb35b644e8

Description
Affected versions of MISP cti-transmute disclose users' email addresses through the account following-list endpoint. When an authenticated user follows another account, get_following() includes the followed user's email field in the API response alongside their name, user ID, and follow date. Because the email address is not required for the functionality and other related user lists omit it, an authenticated attacker could systematically follow users and collect their email addresses. The fix removes user.email from the returned object.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-72760
EUVD
EUVD-2026-55636

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
misp cti-transmute *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in MISP cti-transmute allows authenticated users to view other users' email addresses through the account following-list endpoint. The email addresses are exposed in API responses when users follow each other, even though they are not necessary for the functionality.

Detection Guidance

To detect this vulnerability, monitor API responses from the account following-list endpoint in MISP cti-transmute. Check if the email field is included in the response when following another user. Use tools like curl to inspect API responses: curl -H 'Authorization: Bearer YOUR_TOKEN' https://your-misp-instance/cti-transmute/following-list. If email addresses are exposed, the vulnerability is present.

Impact Analysis

An authenticated attacker could exploit this to systematically collect email addresses of users by following them. This could lead to privacy breaches, spam, or targeted phishing attacks against affected users.

Compliance Impact

This vulnerability likely violates GDPR and other privacy regulations by exposing personal data (email addresses) without a valid purpose. It could result in non-compliance penalties and loss of user trust.

Mitigation Strategies

Immediately update MISP cti-transmute to the latest patched version where the email field is removed from the following-list endpoint response. If an update is not available, disable the following-list endpoint or restrict access to authenticated users only. Review logs for suspicious activity involving the endpoint.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72760. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart