MISP cti-transmute up to 1.4.0 Following List Endpoint get_following information disclosure

Summaryinfo

A vulnerability described as problematic has been identified in MISP cti-transmute up to 1.4.0. This impacts the function get_following of the component Following List Endpoint. Executing a manipulation can lead to information disclosure. This vulnerability is handled as CVE-2026-72760. The attack can be executed remotely. There is not any exploit available.

Detailsinfo

A vulnerability has been found in MISP cti-transmute up to 1.4.0 and classified as problematic. This vulnerability affects the function get_following of the component Following List Endpoint. The manipulation with an unknown input leads to a information disclosure vulnerability. The CWE definition for the vulnerability is CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. As an impact it is known to affect confidentiality. CVE summarizes:

Affected versions of MISP cti-transmute disclose users' email addresses through the account following-list endpoint. When an authenticated user follows another account, get_following() includes the followed user's email field in the API response alongside their name, user ID, and follow date. Because the email address is not required for the functionality and other related user lists omit it, an authenticated attacker could systematically follow users and collect their email addresses. The fix removes user.email from the returned object.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-72760 since 08/10/2026. The exploitation appears to be easy. The attack can be initiated remotely. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1592.

Applying the patch 4bad9f105a824979e0ae79fd6115cd7a88c84ee5 is able to eliminate this problem.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• MISP

Name

• cti-transmute

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4.0

License

• open-source

Website

• Product: https://github.com/MISP/cti-transmute/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion