PT-2026-48998 · Misp · Misp

Andras Iklody + 1 · Published 2026-06-12 · Updated 2026-06-12 · CVE-2026-54396

Mitre

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

An information disclosure vulnerability exists in the MISP AuthKey edit functionality. When a validation error occurs during an AuthKey edit request, the user dropdown was populated using the attacker-controlled AuthKey.user id value from the submitted request data. An authenticated user with permission to edit an AuthKey could submit arbitrary user IDs and observe the returned dropdown data, allowing enumeration of user email addresses. The issue is fixed by deriving the dropdown user from the persisted AuthKey owner instead of the request body.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2026-54396

Affected Products

Misp

References · 2

• https://github.com/MISP/MISP/commit/42737f4e88df801486334690913dd344e447fac3 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-54396 · Security Note