Executive brief
MISP, an open-source threat intelligence platform, contains a vulnerability in its authentication key management interface. An authorized user could exploit this flaw to discover the email addresses of other users on the system by manipulating web requests. This could lead to the exposure of sensitive contact information of security researchers and analysts within the platform.
Technical details
An information disclosure vulnerability exists in the MISP AuthKeysController.php within the edit functionality. When a validation error occurs during an AuthKey edit request, the application populates a user dropdown using the 'user_id' value provided in the request body rather than the value persisted in the database. An authenticated attacker with permissions to edit an AuthKey can submit arbitrary user IDs and observe the returned dropdown data to enumerate user email addresses (CWE-200). The vulnerability is resolved by ensuring the dropdown data is derived from the actual AuthKey owner.
Affected products
- MISP Project MISP Prior to commit 42737f4e88df801486334690913dd344e447fac3
Timeline
- 2026-06-12: disclosed
- 2026-06-12: advisory