CVE-2026-54396

An information disclosure vulnerability exists in the MISP AuthKey edit functionality. When a validation error occurs during an AuthKey edit request, the user dropdown was populated using the attacker-controlled AuthKey.user_id value from the submitted request data. An authenticated user with permission to edit an AuthKey could submit arbitrary user IDs and observe the returned dropdown data, allowing enumeration of user email addresses. The issue is fixed by deriving the dropdown user from the persisted AuthKey owner instead of the request body.

• CWE-200

• https://github.com/MISP/MISP/commit/42737f4e88df801486334690913dd344e447fac3

Published

Jun 12, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-54388Tinyproxy through 1.11.3, fixed in commit 364cdb6, fails to …9.3
• CVE-2026-5439A memory exhaustion vulnerability exists in ZIP archive proc…7.5
• CVE-2026-54390JTL Shop versions 5.2.0 through 5.7.1 contains a server-side…9.8
• CVE-2026-54393A stored cross-site scripting vulnerability exists in MISP w…5.1
• CVE-2026-54394MISP contains a path traversal vulnerability in Organisation…5.3
• CVE-2026-54395MISP contains a reflected cross-site scripting vulnerability…5.3
• CVE-2026-54397A vulnerability in MISP’s non-REST event editing path allowe…6.1
• CVE-2026-54398An authorization flaw in MISP’s object add/edit handling all…5.3
• CVE-2026-54399Uncontrolled Resource Consumption vulnerability in the HTTP/…7.5
• CVE-2026-5440A memory exhaustion vulnerability exists in the HTTP server …7.5
• CVE-2026-54400A malicious actor with access to the network and high privil…9.1
• CVE-2026-54401A malicious actor with access to the network and low privile…8.8