QSearchQSearch

CVE-2026-54396

An information disclosure vulnerability exists in the MISP AuthKey edit functionality

Published: 2026-06-12 · Last updated: 2026-06-12

Severity and scoring

CWE
CWE-200

Description

An information disclosure vulnerability exists in the MISP AuthKey edit functionality. When a validation error occurs during an AuthKey edit request, the user dropdown was populated using the attacker-controlled AuthKey.user_id value from the submitted request data. An authenticated user with permission to edit an AuthKey could submit arbitrary user IDs and observe the returned dropdown data, allowing enumeration of user email addresses. The issue is fixed by deriving the dropdown user from the persisted AuthKey owner instead of the request body.

Source: NVD

References

Related CVEs

Same CWE

  • CVE-2026-49397 — Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool (5.3 MEDIUM)
  • CVE-2026-47124 — Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool (6.5 MEDIUM)
  • CVE-2026-47264 — Discourse is an open-source discussion platform (5.3 MEDIUM)
  • CVE-2026-47263 — Discourse is an open-source discussion platform (4.3 MEDIUM)
  • CVE-2026-45085 — Discourse is an open-source discussion platform (5.3 MEDIUM)