Vulnerability Description
An information disclosure vulnerability exists in the MISP AuthKey edit functionality. When a validation error occurs during an AuthKey edit request, the user dropdown was populated using the attacker-controlled AuthKey.user_id value from the submitted request data. An authenticated user with permission to edit an AuthKey could submit arbitrary user IDs and observe the returned dropdown data, allowing enumeration of user email addresses. The issue is fixed by deriving the dropdown user from the persisted AuthKey owner instead of the request body.
Related Weaknesses (CWE)
References
FAQ
What is CVE-2026-54396?
CVE-2026-54396 is a documented vulnerability. An information disclosure vulnerability exists in the MISP AuthKey edit functionality. When a validation error occurs during an AuthKey edit request, the user dropdown was populated using the attacker...
How severe is CVE-2026-54396?
CVSS scoring is not yet available for CVE-2026-54396. Check NVD for updates.
Is there a patch for CVE-2026-54396?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.