CVE-2026-54396 Details
Description
An information disclosure vulnerability exists in the MISP AuthKey edit functionality. When a validation error occurs during an AuthKey edit request, the user dropdown was populated using the attacker-controlled AuthKey.user_id value from the submitted request data. An authenticated user with permission to edit an AuthKey could submit arbitrary user IDs and observe the returned dropdown data, allowing enumeration of user email addresses. The issue is fixed by deriving the dropdown user from the persisted AuthKey owner instead of the request body.
A vulnerability allowing information disclosure exists in the MISP AuthKey edit feature. When a validation error arises during an AuthKey edit request, the user dropdown is populated with data from the attacker-controlled AuthKey.user_id value included in the request. This allows an authenticated user with permission to edit an AuthKey to submit arbitrary user IDs and retrieve corresponding dropdown data, facilitating enumeration of user email addresses. The vulnerability has been addressed by changing the source of the dropdown user to the actual owner of the AuthKey, rather than the user ID provided in the request.
Users can update to MISP version 2.5.40 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 12, 2026CISA-ADP
Assessed Jun 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/MISP/MISP/commit/42737f4e88df801486334690913dd344e447fac3 | CIRCL | Source CodeVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | CIRCL |
Affected Products
| Product | Versions |
|---|---|
| MISP | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | CIRCL |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 12, 2026 | New CVE Received | CIRCL |