CVE-2026-72760
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
Affected versions of MISP cti-transmute disclose users' email addresses through the account following-list endpoint. When an authenticated user follows another account, get_following() includes the followed user's email field in the API response alongside their name, user ID, and follow date. Because the email address is not required for the functionality and other related user lists omit it, an authenticated attacker could systematically follow users and collect their email addresses. The fix removes user.email from the returned object.
Risk Assessment
Risk of privacy violation through unauthorized collection of email addresses, potentially leading to phishing campaigns or other social engineering attacks.
Recommendation
It is recommended to update immediately to a version containing the fix that removes the email field from the API response.
Other vulnerabilities in MISP cti-transmute
Original NVD description (English source)
Affected versions of MISP cti-transmute disclose users' email addresses through the account following-list endpoint. When an authenticated user follows another account, get_following() includes the followed user's email field in the API response alongside their name, user ID, and follow date. Because the email address is not required for the functionality and other related user lists omit it, an authenticated attacker could systematically follow users and collect their email addresses. The fix removes user.email from the returned object.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS