CVE-2026-54396: MISP AuthKey edit endpoint allows authenticated user email enumeration
An information disclosure vulnerability exists in the MISP AuthKey edit functionality. When a validation error occurs during an AuthKey edit request, the user dropdown was populated using the attacker-controlled AuthKey.userid value from the submitted request data. An authenticated user with permission to edit an AuthKey could submit arbitrary user IDs and observe the returned dropdown data, allowing enumeration of user email addresses. The issue is fixed by deriving the dropdown user from the persisted AuthKey owner instead of the request body.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Change the AuthKey edit handling so the user dropdown is derived from the persisted AuthKey owner (database) rather than from AuthKey.user_id in the submitted request body to prevent disclosure of user emails.
MISP AuthKey edit endpoint dropdown_user_source = persisted AuthKey owner - Compensating control
Restrict who can edit AuthKeys to a minimal set of trusted administrators via application ACLs/roles; apply least-privilege to AuthKey edit functionality and consider WAF rules or request validation to block requests that supply arbitrary user_id values.
- Operational
Audit application logs for AuthKey edit requests (look for repeated requests with different user_id values) to detect possible enumeration attempts, review recent activity for suspicious behavior, and notify or investigate potentially impacted user accounts.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-54396?
CVE-2026-54396 has a medium severity rating of 5.3 on the CVSS scale.
How do I fix CVE-2026-54396?
To fix CVE-2026-54396, update to the latest version of MISP that addresses the AuthKey edit endpoint vulnerabilities.
What systems are affected by CVE-2026-54396?
CVE-2026-54396 affects the MISP Project software, specifically its AuthKey edit functionality.
What type of vulnerability is CVE-2026-54396?
CVE-2026-54396 is classified as an information disclosure vulnerability.
How does CVE-2026-54396 allow email enumeration?
CVE-2026-54396 allows email enumeration through the user dropdown being populated with attacker-controlled values during validation errors on AuthKey edit requests.