CVE-2026-72760: MISP cti-transmute Information Disclosure

CVE-2026-72760 Overview

CVE-2026-72760 is an information disclosure vulnerability [CWE-200] in MISP cti-transmute. The get_following() function in the account following-list endpoint returns each followed user's email address alongside their name, user ID, and follow date. The email field is not required for the follow functionality, and other related user lists omit it. An authenticated attacker can systematically follow accounts to harvest their email addresses at scale. The maintainers addressed the issue by removing user.email from the returned object.

Critical Impact
Authenticated attackers can enumerate registered users and collect their email addresses through the follow API, enabling targeted phishing and account-correlation attacks against MISP cti-transmute deployments.

Affected Products

MISP cti-transmute (website component)
Deployments running versions prior to commit 4bad9f1
Instances exposing the account following-list API to authenticated users

Discovery Timeline

2026-08-10 - CVE-2026-72760 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-72760

Vulnerability Analysis

The vulnerability resides in website/web/account/account.py within the get_following() handler. When an authenticated user requests the list of accounts they follow, the endpoint constructs a list of dictionaries describing each followed account. The response object includes user_id, name, email, and since. The email field is not needed to render or use the following list, and comparable endpoints for related user lists omit it. This inconsistency creates an over-permissive data exposure.

Because the endpoint is reachable by any authenticated user, an attacker with a low-privilege account can iteratively follow other accounts and read back their email addresses. The vulnerability is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor).

Root Cause

The root cause is a violation of least-privilege data exposure in the API response builder. The follow list serializer included the email attribute from the ORM user object without evaluating whether the caller needed it. No authorization check gated the inclusion of email data, and no data-minimization policy existed for user profile projections returned by follow-related endpoints.

Attack Vector

An authenticated attacker follows a target account through the standard follow API. The attacker then calls the following-list endpoint and parses the returned JSON to extract the target's email address. Iterating this process across enumerated user_id values allows bulk collection of registered emails. The attack requires low privileges, needs no user interaction, and is executed over the network.

python

             items.append({
                 "user_id": user.id,
                 "name": f"{user.first_name} {user.last_name}",
-                "email": user.email,
                 "since": f.created_at.strftime('%Y-%m-%d') if f.created_at else None
             })
     return {"success": True, "list": items, "total_page": pagination.pages}, 200
// Source: https://github.com/MISP/cti-transmute/commit/4bad9f105a824979e0ae79fd6115cd7a88c84ee5

The patch, shown above, removes the email field from the response object so the following list only returns user_id, name, and since.

Detection Methods for CVE-2026-72760

Indicators of Compromise

Repeated calls to the account following-list endpoint from a single authenticated session correlating with sequential follow actions.
Follow events created against many distinct user_id values within a short window from one account.
API responses from vulnerable versions containing the email key in each item of the list array.

Detection Strategies

Review application access logs for anomalous request rates to the follow and following-list endpoints per authenticated user.
Diff API responses in staging against the patched schema to confirm removal of the email field.
Add data loss prevention rules that flag JSON responses containing email values inside follow-related payloads.

Monitoring Recommendations

Track per-account follow velocity and alert on accounts that follow an unusually large number of users.
Instrument the get_following() handler with structured logging that captures caller identity, response size, and pagination depth.
Correlate email-harvesting patterns with subsequent phishing indicators reaching the exposed addresses.

How to Mitigate CVE-2026-72760

Immediate Actions Required

Update MISP cti-transmute to a build that includes commit 4bad9f105a824979e0ae79fd6115cd7a88c84ee5.
Audit historical follow activity for accounts exhibiting bulk-follow behavior and reset credentials where warranted.
Notify users whose email addresses may have been exposed if evidence of exploitation exists.

Patch Information

The fix is available in the upstream repository via the GitHub Commit for CTI Transmute. The commit removes user.email from the dictionary appended in get_following() so the API no longer returns the field. Operators should pull the latest cti-transmute main branch or a release tag containing this commit and redeploy the website component.

Workarounds

Restrict access to the account following-list endpoint at the reverse proxy or WAF layer until the patch is applied.
Apply the one-line change locally in website/web/account/account.py to drop the email key from the response.
Rate-limit follow and following-list requests per authenticated session to slow enumeration attempts.

bash

# Apply the upstream fix locally
cd cti-transmute
git fetch origin
git cherry-pick 4bad9f105a824979e0ae79fd6115cd7a88c84ee5
# Redeploy the website component
systemctl restart cti-transmute-website