CVE-2026-72760: cti-transmute Following List Exposes User Email Addresses to Authenticated Users
Affected versions of MISP cti-transmute disclose users' email addresses through the account following-list endpoint. When an authenticated user follows another account, getfollowing() includes the followed user's email field in the API response alongside their name, user ID, and follow date. Because the email address is not required for the functionality and other related user lists omit it, an authenticated attacker could systematically follow users and collect their email addresses. The fix removes user.email from the returned object.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update cti-transmute so the get_following() API response does not include the followed user's email field in the returned object; return only name, user ID, and follow date.
MISP cti-transmute (Following list API / returned user object) user.email field in get_following() API response = removed (no longer returned)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72760?
CVE-2026-72760 has a risk rating of 26, indicating a significant exposure of user information.
How do I fix CVE-2026-72760?
To mitigate CVE-2026-72760, update to the latest version of MISP cti-transmute where the issue is resolved.
What type of data is exposed in CVE-2026-72760?
CVE-2026-72760 exposes user email addresses through the following-list API endpoint for authenticated users.
Who is affected by CVE-2026-72760?
Authenticated users of the MISP cti-transmute software can access the exposed email addresses of followed accounts.
What are the implications of CVE-2026-72760?
CVE-2026-72760 can lead to unauthorized disclosure of user email addresses, potentially facilitating phishing attacks.