CVE-2026-54396
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk16th percentile — higher than 16% of all known CVEs
Summary
An information disclosure vulnerability exists in the MISP AuthKey edit functionality. When a validation error occurs during an AuthKey edit request, the user dropdown was populated using the attacker-controlled AuthKey.user_id value from the submitted request data, allowing enumeration of user email addresses.
Risk Assessment
The organization may be exposed to the disclosure of user email addresses, potentially leading to further attacks such as phishing. Allowing attackers access to user information poses a serious threat to data security.
Recommendation
It is recommended to update the system to the latest version where this vulnerability has been fixed to ensure that the user dropdown is derived from the persisted AuthKey owner instead of the request body.
Original NVD description (English source)
An information disclosure vulnerability exists in the MISP AuthKey edit functionality. When a validation error occurs during an AuthKey edit request, the user dropdown was populated using the attacker-controlled AuthKey.user_id value from the submitted request data. An authenticated user with permission to edit an AuthKey could submit arbitrary user IDs and observe the returned dropdown data, allowing enumeration of user email addresses. The issue is fixed by deriving the dropdown user from the persisted AuthKey owner instead of the request body.