CVE-2026-72760 in cti-transmute
Summary
by MITRE • 08/10/2026
Affected versions of MISP cti-transmute disclose users' email addresses through the account following-list endpoint. When an authenticated user follows another account, get_following() includes the followed user's email field in the API response alongside their name, user ID, and follow date. Because the email address is not required for the functionality and other related user lists omit it, an authenticated attacker could systematically follow users and collect their email addresses. The fix removes user.email from the returned object.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/10/2026
The vulnerability identified in MISP cti-transmute represents a critical privacy and data exposure issue that undermines user confidentiality within the platform's account following functionality. This flaw exists specifically within the account following-list endpoint where the get_following() function inadvertently includes sensitive user email addresses in API responses alongside standard profile information such as name, user ID, and follow date. The vulnerability affects all versions of MISP cti-transmute that implement this particular endpoint functionality, creating a systematic risk for user privacy across the entire platform.
The technical implementation flaw stems from an improper data filtering mechanism within the API response construction process. When authenticated users engage with the following feature, the system fails to properly sanitize the response payload by excluding the email field from the returned data structure. This represents a clear violation of principle of least privilege and data minimization practices that should govern all user-facing API endpoints. The flaw is particularly concerning because it operates as an enumeration mechanism that allows attackers to systematically collect user contact information without requiring elevated privileges or specific attack vectors.
The operational impact of this vulnerability extends beyond simple privacy concerns to potentially enable various malicious activities including social engineering campaigns, targeted phishing attacks, and coordinated harassment attempts. An authenticated attacker can leverage this functionality to build comprehensive databases of user email addresses by following multiple accounts over time, effectively creating a surveillance mechanism that undermines the platform's security posture. This type of information disclosure aligns with CWE-201: Information Exposure Through Sent Data and represents a significant deviation from expected API security practices.
The mitigation strategy involves implementing proper response filtering to exclude sensitive fields such as user.email from the get_following() API endpoint responses, ensuring that only necessary data elements are returned to authenticated users. This fix directly addresses the root cause by modifying the data retrieval logic to strip email addresses from the response payload before transmission, thereby preventing unauthorized disclosure while maintaining all legitimate functionality of the following feature. The solution should be implemented with careful attention to maintain backward compatibility and ensure that existing user experience is not compromised.
This vulnerability demonstrates a fundamental security gap in API design practices that aligns with ATT&CK technique T1566: Phishing and T1071.1: Application Layer Protocol. The flaw essentially creates an information gathering capability that could be weaponized through automated scripts to systematically collect user data, making it particularly dangerous for platforms handling sensitive threat intelligence information. The incident highlights the importance of regular API security reviews and proper input/output validation procedures, emphasizing that even seemingly benign features can create significant exposure points when not properly secured against data leakage scenarios.