Executive brief
MISP cti-transmute is a web application that manages threat intelligence data and user accounts. An authenticated attacker can harvest email addresses of other users by repeatedly following accounts, as the following-list API endpoint unintentionally exposes email addresses alongside basic user information. This could enable targeted phishing campaigns or account enumeration attacks against users.
Technical details
The vulnerability is an information disclosure flaw in the get_following() API endpoint within the account management module. The root cause is the inclusion of the user.email field in the JSON response object returned when querying a user's following list, even though email is not required for UI functionality and is intentionally omitted from related endpoints (followers list, user search). An authenticated attacker can exploit this by following users and collecting their email addresses from the API responses, requiring no special privileges beyond a valid account. The fix removes the email field from the returned JSON structure.
Affected products
- MISP cti-transmute
Timeline
- 2026-08-10: disclosed
- 2026-08-10: patched