CVE-2026-72760

Affected versions of MISP cti-transmute disclose users' email addresses through the account following-list endpoint. When an authenticated user follows another account, get_following() includes the followed user's email field in the API response alongside their name, user ID, and follow date. Because the email address is not required for the functionality and other related user lists omit it, an authenticated attacker could systematically follow users and collect their email addresses. The fix removes user.email from the returned object.

• CWE-200

• https://github.com/MISP/cti-transmute/commit/4bad9f105a824979e0ae79fd6115cd7a88c84ee5

Published

Aug 10, 2026

Last Modified

Aug 10, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-72747AVideo fails to sanitize the phone field during user registr…7.2
• CVE-2026-72748AVideo contains an unauthenticated arbitrary file write vuln…9.1
• CVE-2026-72749n8n before 1.123.67, 2.31.5, and 2.32.1 contains a prototype…7.1
• CVE-2026-72750n8n before 1.123.67, 2.31.5, and 2.32.1 contains a SQL injec…5.3
• CVE-2026-72751CTI-Transmute is affected by a stored cross-site scripting (…5.1
• CVE-2026-72759In affected versions of MISP cti-transmute, the conversion-h…6.9
• CVE-2026-72761The webhook URL validator in `website/notifications/webhooks…6.9
• CVE-2026-72762n8n versions before 1.123.67, 2.31.5, and 2.32.1 contain an …7.7
• CVE-2026-72763n8n before 1.123.67, 2.31.5, and 2.32.1 validates credential…7.2
• CVE-2026-72764n8n's JavaScript task runner shared a single module cache ac…5.8
• CVE-2026-72765n8n before 2.31.5 and before 2.32.1 contain a sandbox escape…8.7
• CVE-2026-72766n8n before 1.123.67, 2.x before 2.31.5, and 2.32.x before 2.…8.2