CVE-2026-54396 MISP AuthKey edit endpoint allows authenticated user email enumeration
Authenticated users can enumerate email addresses by manipulating user IDs in AuthKey edit requests, exposing sensitive user data.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-54396?
CVE-2026-54396 is a medium-severity vulnerability in misp, published on 12 Jun 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
An information disclosure vulnerability exists in the MISP AuthKey edit functionality. When a validation error occurs during an AuthKey edit request, the user dropdown was populated using the attacker-controlled AuthKey.user_id value from the submitted request data. An authenticated user with permission to edit an AuthKey could submit arbitrary user IDs and observe the returned dropdown data, allowing enumeration of user email addresses. The issue is fixed by deriving the dropdown user from the persisted AuthKey owner instead of the request body.
Weakness: CWE-200
Which versions are affected by CVE-2026-54396?
How do I fix CVE-2026-54396?
No fix has been published for CVE-2026-54396 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-54396 being exploited?
There is no known exploitation of CVE-2026-54396 in the wild and no public exploit code.
Sources
Also known as GHSA-xcgf-2j9f-cvgv.