Improper Authentication (CWE-287) in Dell Secure Connect Gateway (SCG) 5.0 enables a remote, low-privileged attacker to bypass protection mechanisms, potentially gaining access to sensitive telemetry or support data beyond their authorized scope. Both the Appliance variant (prior to 5.36.00.16) and Application variant (prior to 5.36.00.00) are affected, as confirmed in Dell advisory DSA-2026-382. No public exploit code or active exploitation has been identified at time of analysis, but the network-accessible attack vector and low authentication bar make patching a clear priority.
Improper locking in Dell Secure Connect Gateway (SCG) 5.0 Appliance and Application allows a low-privileged remote attacker to exploit a synchronization race condition, resulting in unauthorized filesystem access on the affected system. The vendor CVSS vector rates the primary impact as A:H (Availability), yet the description specifically references attacker filesystem access - a tension that suggests possible confidentiality or integrity impact beyond what the official score reflects. Dell has released fixed versions and published advisory DSA-2026-382; no public exploit or active CISA KEV listing exists at time of analysis.
Missing server-side permission checks in JetBrains YouTrack before 2026.2.18687 allow any authenticated user to create knowledge base articles inside projects they are not authorized to access. The flaw is rooted in CWE-862 (Missing Authorization), where the article-creation endpoint omits the necessary access control validation against the caller's project permissions. No public exploit or active exploitation has been identified; the CVSS PR:L metric confirms exploitation is limited to users who already hold a valid YouTrack account.
Improper authorization in JetBrains YouTrack before 2026.2.18634 allows authenticated read-only users to create and modify whiteboard cards, exceeding their intended permissions. The flaw (CWE-863) bypasses YouTrack's role-based access controls for the whiteboard feature, enabling low-privileged users to perform write operations they should be denied. No public exploit code or active exploitation has been identified, and a vendor-confirmed fix is available. EPSS data was not provided; real-world risk is moderate given the authentication prerequisite.
Insufficient permission checks on the app import endpoint in JetBrains YouTrack before version 2026.2.18634 allow an authenticated low-privileged user to overwrite bundled applications, achieving high-integrity impact across all unpatched deployments. The flaw is rooted in CWE-863 (Incorrect Authorization), meaning the server fails to validate that the requesting account holds sufficient privileges for a destructive write operation against pre-installed components. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Arbitrary shortcode execution in the Icegram Email Subscribers & Newsletters WordPress plugin (all versions through 5.9.27) allows unauthenticated network attackers to invoke registered WordPress shortcodes without authentication. The flaw originates in the plugin's email workflow and subscription handling code, which passes user-controlled input to `do_shortcode()` without adequate validation - enabling attackers to trigger any shortcode registered on the target site. Depending on the shortcodes available, impact ranges from information disclosure and content manipulation to potential code execution; no public exploit or CISA KEV listing has been identified at time of analysis.
Stored Cross-Site Scripting in the Powerkit WordPress plugin (all versions up to and including 3.0.4) allows authenticated Contributors to permanently embed malicious JavaScript into published pages via a flawed regex-based HTML attribute parser in the Lazy Load module's `content_process_images` function. Any site visitor who subsequently loads an injected page triggers script execution in their browser context, enabling session hijacking, credential theft, or malicious redirects. A fix is confirmed available via WordPress plugin Trac changeset 3604146; no active exploitation or public exploit code has been identified at time of analysis.
OAuth2 state-changing protocol endpoints in ash_authentication_oauth2_server (versions 0.1.0 through 0.3.0) are silently reachable under a second, unintended URL prefix (`/.well-known`) due to Phoenix's `forward` macro stripping the matched prefix before dispatch, leaving both `/oauth` and `/.well-known` mounts backed by the same ProtocolRouter route table. POST requests to `/register`, `/token`, and `/revoke` therefore answer under `/.well-known/register`, `/.well-known/token`, and `/.well-known/revoke`, bypassing any WAF rules, rate-limiting policies, or authentication exemptions scoped exclusively to the canonical `/oauth` prefix. No public exploit has been identified and the vulnerability is absent from CISA KEV; vendor patch version 0.3.1 is available.
Dynamic Client Registration (DCR) bypass in ash_authentication_oauth2_server versions 0.1.0 through 0.3.0 allows unauthenticated network attackers to register OAuth clients on servers that were configured to require an initial access token. The root cause is a fail-open pattern in resolve_secret/3: when a configured secret provider returned nil, false, or an empty string instead of a structured :error tuple, the function wrapped the value as {:ok, value} and passed it to the bearer-token comparison, causing that comparison to succeed against any request. No public exploit code has been identified, and the vendor has released a patched version (0.3.1).
WWW-Authenticate header parameter injection in ash_authentication_oauth2_server (versions 0.1.3 through 0.3.0) allows unauthenticated network attackers to smuggle arbitrary OAuth2 auth-params into Bearer challenge headers by supplying a tenant value containing a double-quote character. In multi-tenant Elixir/Phoenix applications that derive the Ash tenant from request-controlled data such as subdomains, Host headers, or path segments, an attacker can inject a second resource_metadata URL pointing to an attacker-controlled authorization server. Spec-compliant OAuth2 clients that follow the resource_metadata discovery URL will then contact the attacker's server instead of the legitimate one, enabling token theft or credential harvesting. No public exploit has been identified at time of analysis; a vendor-released patch is available at version 0.3.1.
SSRF in ash_authentication_oauth2_server 0.3.0 allows an attacker who controls both an OAuth2 client's metadata URL and the associated DNS resolution to route the server's outbound CIMD metadata fetches to loopback, link-local, or internal addresses. The `public_ip?/1` guard in `AshAuthentication.Oauth2Server.CIMD.ReqFetcher` failed to classify three IPv6 address families as private - IPv4-compatible ::/96 (e.g., ::127.0.0.1), SIIT IPv4-translated ::ffff:0:0:0/96, and deprecated site-local fec0::/10 - so a crafted DNS AAAA response in any of these ranges bypassed the policy. No public exploit has been identified at time of analysis; vendor patch released in version 0.3.1.
Multi-tenant OAuth2 metadata cross-tenant leakage in ash_authentication_oauth2_server (versions 0.1.3 through before 0.3.1) causes shared HTTP caches to serve one tenant's RFC 8414/RFC 9728 discovery metadata - including issuer, authorization_endpoint, token_endpoint, and jwks_uri - to another tenant's clients for up to one hour. The vulnerability arises because the Phoenix ProtocolRouter sent all metadata responses with Cache-Control: public, max-age=3600 and no Vary header; when tenant identity is derived from a request header or Host (not the URL), shared caches key on URL alone, making cross-tenant cache poisoning trivially repeatable. Downstream impact extends beyond disclosure: affected clients may direct authorization codes and client secrets to the wrong tenant's token endpoint and validate tokens against the wrong JWKS keys. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis.
Memory exhaustion in ImageMagick's MSL image decoder affects versions before 7.1.2-30 (v7 branch) and 6.9.13-55 (v6 branch), enabling unauthenticated network attackers to degrade or crash image-processing services by submitting crafted MSL files that trigger unbounded heap allocation without deallocation. The root cause (CWE-400, Uncontrolled Resource Consumption) lies in the MSL decoder's failure to free allocated memory on certain code paths, allowing cumulative heap exhaustion across repeated requests. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; the CVSS 4.0 score of 6.3 (Medium) reflects limited availability-only impact with elevated attack complexity.
Memory budget exhaustion in ImageMagick's OpenPixelCache allows remote unauthenticated attackers to cause a process-level denial of service by repeatedly triggering internal cache operation failures. Affected versions span both the 7.x branch (before 7.1.2-30) and the legacy 6.x branch (before 6.9.13-55), covering a large installed base of web services that process user-supplied images. The vulnerability stems from improper cleanup of memory accounting state on error paths, making the failure accumulative rather than self-correcting. No public exploit or CISA KEV listing has been identified at time of analysis.
Privilege escalation in Zohocorp ManageEngine Endpoint Central below version 11.4.2540.23 allows a local low-privileged user to gain elevated access via a path-traversal or symlink-following flaw during JAR archive extraction. The Endpoint Central service, which typically runs under a high-privileged system account, unsafely extracts attacker-influenced JAR contents, permitting file writes outside the intended extraction directory and into privileged locations. No public exploit has been identified at time of analysis, and a vendor patch is available.
Privilege escalation in Zohocorp ManageEngine Endpoint Central below version 11.5.2600.15 permits a locally authenticated low-privilege user to gain elevated access by exploiting an outdated bundled third-party component (CWE-269). The CVSS scope change (S:C) indicates impacts extend beyond the vulnerable component itself, potentially reaching OS-level resources or other managed endpoints under the platform's control. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Integer overflow in Samsung Walrus WebAssembly runtime's Memory::init() source-bounds check allows an attacker who supplies a crafted WebAssembly module to trigger a 32-bit unsigned wrap-around that bypasses source-bounds validation, causing an out-of-bounds heap read and process crash (denial of service). The affected product is Samsung Walrus at commit ff3bf5ff5c4878f8e5572c9593d303f6bc997443 across all platforms. Publicly available exploit code exists in the form of a proof-of-concept .wast module (stream-read-oob-poc.wast) included in the upstream fix PR #482.
Out-of-bounds write in Samsung's Escargot JavaScript engine on Linux x86-64 allows process crash when a crafted class definition is supplied for execution. Numeric truncation (CWE-197) occurs when an instance initialization entry count exceeding UINT16_MAX is stored in a uint16_t field, producing a corrupted count that drives subsequent out-of-bounds memory writes and host process termination. Impact is limited to availability (denial of service); no confidentiality or integrity exploitation is indicated, and no public exploit or CISA KEV listing has been identified at time of analysis.
Undefined memory access in PKCS#7 container parsing affects an Ubuntu-packaged cryptographic library, potentially enabling denial of service or information disclosure when processing malformed PKCS#7 input. The specific library (OpenSSL, GnuTLS, NSS, or Linux kernel PKCS#7 module) is not identified in available data. No patch version, CVSS score, or CWE classification was provided, leaving severity and exploitability largely unquantified at time of analysis.
Unbounded iteration during PKCS#7 container decryption exposes affected systems to a denial-of-service condition where a crafted cryptographic payload causes a parsing loop to run without termination bounds. The specific library or package is not identified in the available intelligence - Ubuntu is the reporting source, suggesting this affects a cryptographic library they distribute (candidates include OpenSSL, GnuTLS, NSS, or similar). An attacker able to supply a malformed PKCS#7 container to a vulnerable parsing routine can exhaust CPU resources and halt service availability. No public exploit has been identified at time of analysis, and no CVSS score or severity rating has been assigned.
NULL-pointer dereference in code handling Authentication and Key Agreement (AKA) Synchronization-Failure messages causes a process crash when a malformed or unexpected AKA-Synchronization-Failure response is processed. The vulnerability affects software that implements 3GPP AKA authentication - a protocol used in mobile network authentication (3G/4G/5G) and EAP-AKA for Wi-Fi/IMS - as packaged by Ubuntu. No public exploit or CISA KEV listing has been identified at time of analysis, and the primary real-world impact is denial of service via crash of the authentication handling daemon.
Unauthenticated network exposure of Go runtime profiling data affects JetBrains GoLand IDE versions prior to 2026.2.2.1, where the IDE injects a pprof HTTP server into profiled processes without any access control. An attacker with network connectivity to the developer workstation during an active profiling session can retrieve heap dumps, goroutine stacks, CPU traces, and in-memory data structures that may contain credentials, tokens, or sensitive application state. No public exploit code exists and this is not listed in CISA KEV; however, the attack requires only standard HTTP requests against an unauthenticated endpoint, making it trivially simple when the prerequisite conditions are met.
Improper certificate validation in Dell Secure Connect Gateway 5.0 (both Appliance and Application editions) exposes encrypted communications to interception by remote, unauthenticated attackers positioned on the network path. The vulnerability stems from CWE-295 failure to properly verify TLS/SSL certificates, enabling a MITM attacker to present a fraudulent certificate that the product accepts, thereby gaining access to traffic that should be protected. CVSS 5.9 (AC:H) reflects that exploitation requires the attacker to occupy an adversarial network position; no public exploit or KEV listing has been identified at time of analysis.
Local privilege escalation in Zohocorp ManageEngine Endpoint Central before version 11.5.2605.01 allows a low-privileged local user to gain elevated access by exploiting improper privilege management (CWE-269) during the agent upgrade process. The CVSS scope change (S:C) confirms that exploitation crosses privilege boundaries beyond the initially compromised context, affecting higher-privileged system components. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog at time of analysis; vendor patch is confirmed available.
Pre-authentication Child SA creation in an IKEv2/IPsec implementation reported via Ubuntu allows a network attacker to establish a Child Security Association before the IKE authentication phase completes. In the IKEv2 protocol (RFC 7296), Child SAs should only be negotiated after mutual authentication of the IKE SA; bypassing this ordering can undermine the confidentiality and integrity guarantees of the protected traffic tunnels. No public exploit has been identified at time of analysis, and the exact affected Ubuntu package and versions are not confirmed from the available data.
Improper certificate validation in Dell Secure Connect Gateway (SCG) 5.0 - both Appliance (prior to 5.36.00.16) and Application/Virtual Edition (prior to 5.36.00.00) - allows an unauthenticated remote attacker with a network man-in-the-middle position to intercept or tamper with TLS-protected communications between the SCG and remote endpoints. The CVSS 5.6 score with AC:H reflects that exploitation is constrained by the requirement for network-level interception capability rather than direct remote access. No public exploit code and no CISA KEV listing have been identified at time of analysis.
The Windows interactive service in OpenVPN 2.4.0 through 2.6.22 allows local authenticated users to bypass the trusted configuration directory constraint by exploiting incorrect file path validation logic (CWE-73), causing the privileged service to load attacker-controlled VPN configurations. The impact is integrity-focused: a successful bypass enables substitution of legitimate VPN configuration with a malicious one, potentially redirecting traffic, disabling certificate validation, or weakening encryption enforced by an administrator. No public exploit code or CISA KEV listing has been identified at time of analysis, and exploitation is limited to the local Windows context.
Authentication bypass in the light0011 CMS Cookie Helper allows remote unauthenticated attackers to manipulate the Username argument in App/Home/Model/UserModel.class.php and impersonate arbitrary users without valid credentials. The vulnerability (CWE-287, Improper Authentication) affects all commits through at least c774dce31c6df0055568a8d5c53d964d99be199d and f72cf46f601efb2a0618c3814cc2f61380b38930 of this PHP CMS. Publicly available exploit code exists; the project maintainer has not yet responded to disclosure, and no patch has been released.
SQL identifier injection in jaychouchannel's Tourism-Management-System allows remote unauthenticated attackers to enumerate arbitrary database tables and columns by manipulating the `tableName` and `columnName` URL path parameters accepted by multiple endpoints in `CommonController.java`. All commits up to 8122bf020d91199eddfff3ee02d1632a70a9a132 are affected, and exploit code has been publicly disclosed via VulDB. A fix commit (d44ec3aa) is available, introducing a dedicated `SqlIdentifierValidator` to whitelist valid SQL identifiers across the affected controller.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 allows unauthenticated remote attackers to manipulate the `id` parameter in `/delete_subject.php` to execute arbitrary SQL queries against the backend database. The vulnerability requires no authentication or user interaction, and a public exploit has been released via a GitHub vulnerability report. Internet-exposed deployments face immediate risk of database enumeration, credential theft, and academic record manipulation.
Privilege escalation in JetBrains YouTrack before version 2026.1.14047 allows an authenticated user holding project update permissions to grant themselves the Project Admin role without proper authorization. The vulnerability stems from a missing escalation check (CWE-266: Incorrect Privilege Assignment) in the project permissions workflow, enabling a project contributor to cross a privilege boundary and assume administrative control over a project. No active exploitation has been confirmed (not listed in CISA KEV), and no public exploit code is known at time of analysis.
Use-after-free in the MediaTek GPU kernel driver on chipsets MT6991 and MT8799 allows a local attacker with standard user privileges to read freed kernel or GPU memory, potentially exposing sensitive data such as pointers, credentials, or cryptographic material. The same condition may cause a full system crash, consistent with the Denial of Service tag and the 'system crash' language in the description. No public exploit has been identified and SSVC rates exploitation status as none, placing this in a lower real-world priority bracket despite the C:H rating.
Improper input validation in the modem firmware component of 22 MediaTek chipsets allows a local user-privileged process to trigger a system crash, resulting in a denial of service. The flaw, tracked as patch ID MOLY01810811 / MSV-9232, requires user interaction to trigger and is confined to an unprivileged local context, limiting its practical impact to availability disruption rather than data exposure or code execution. No public exploit has been identified and SSVC rates exploitation as none at this time.
MiracastService on MediaTek Smart TV and DTV chipsets exposes a confused deputy condition (CWE-926) that allows a local app running with user-level privileges to trigger a denial-of-service against the Wi-Fi Display subsystem. The flaw stems from an improperly exported Android application component that lets an unprivileged caller invoke MiracastService capabilities without holding the necessary permissions, crashing or disabling the service. No public exploit code exists and SSVC rates exploitation as none, placing this firmly in the routine patch tier with a vendor-confirmed CVSS 5.5.
Incorrect permission assignment on critical resources in Dell Secure Connect Gateway 5.0 (both Appliance and Application variants) enables a locally authenticated low-privileged user to read sensitive data they are not authorized to access. Affected are Appliance versions prior to 5.36.00.16 and Application versions prior to 5.36.00.00, as confirmed in Dell advisory DSA-2026-382. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, though the high confidentiality impact from a CWE-732 flaw in a remote-support gateway warrants prioritized patching for insider-threat scenarios.
Sensitive information exposure in Dell Secure Connect Gateway (SCG) 5.0 allows a low-privileged local attacker to read sensitive data written to application log files without sanitization. Both the Appliance variant (prior to 5.36.00.16) and the Application variant (prior to 5.36.00.00) are affected across all platforms. No public exploit code or active exploitation has been identified; Dell has released fixes via advisory DSA-2026-382.
Hard-coded cryptographic key exposure in Dell Secure Connect Gateway (SCG) 5.0 allows a local low-privileged attacker to decrypt protected data, leading to high-severity information disclosure. Both the Appliance form factor (prior to 5.36.00.16) and the Application form factor (prior to 5.36.00.00) are affected. No public exploit code or active exploitation has been identified at time of analysis, and the local access requirement significantly constrains the attack surface.
Hardcoded cryptographic key exposure in Dell Secure Connect Gateway (SCG) 5.0 - both Appliance and Application variants - allows a low-privileged local attacker to access protected data encrypted with the embedded key, leading to information disclosure. Affected versions include SCG 5.0 Appliance prior to 5.36.00.16 and SCG 5.0 Application prior to 5.36.00.00. Dell has released patched versions via DSA-2026-382; no public exploit or KEV listing has been identified at time of analysis.
Hard-coded cryptographic key exposure in Dell Secure Connect Gateway (SCG) 5.0 allows a local low-privileged attacker to decrypt data that was intended to be cryptographically protected, resulting in high-severity information disclosure. Both the Appliance form factor (versions prior to 5.36.00.16) and the Application form factor (versions prior to 5.36.00.00) are affected. No public exploit code or active exploitation has been identified at time of analysis; Dell has released patches via advisory DSA-2026-382.
Cleartext storage of sensitive information in Dell Secure Connect Gateway 5.0 exposes credentials or configuration secrets to any low-privileged local user on the host. Both the hardware Appliance (versions prior to 5.36.00.16) and the virtual Application (versions prior to 5.36.00.00) are affected, as confirmed by Dell Security Advisory DSA-2026-382. No public exploit identified at time of analysis, but the CVSS C:H rating indicates that successful exploitation yields full confidentiality compromise of the stored sensitive material.
Improper certificate validation in Dell Secure Connect Gateway (SCG) 5.0 allows a locally authenticated low-privileged attacker to conduct server-side request forgery, resulting in high confidentiality impact with no integrity or availability loss. Both the Appliance variant (prior to 5.36.00.16) and the Application variant (prior to 5.36.00.00) are affected, as confirmed by Dell Security Advisory DSA-2026-382. No public exploit code and no CISA KEV listing have been identified at time of analysis, placing this in routine patch-cycle priority rather than emergency response.
Stored cross-site scripting in JetBrains YouTrack before version 2026.2.18634 allows authenticated low-privileged users to inject persistent malicious scripts through custom field values displayed on Agile board cards. When a victim with an active YouTrack session views the affected Agile board, the injected script executes in their browser context, enabling session hijacking, credential theft, or unauthorized actions on their behalf. No public exploit code has been identified at time of analysis, and JetBrains has released a patched version.
Authorization bypass in the Flamingo WordPress plugin (all versions ≤2.6.2) allows authenticated contributor-level users to enumerate sensitive internal metadata via unprotected WordPress core API endpoints. The plugin's capability filter `flamingo_map_meta_cap()` secures the admin UI but leaves XML-RPC `wp.getTerms` and admin-ajax `ajax-tag-search` without equivalent checks, exposing Contact Form 7 channel names, department identifiers, workflow names, submission counts per channel, and contact tag names. No public exploit is identified at time of analysis; the fix is available via plugin changeset 3611179.
Remote unauthenticated denial-of-service in Dell Secure Connect Gateway (SCG) 5.0 allows network-adjacent attackers to crash or disable the gateway's protection mechanisms by sending crafted input that triggers an unhandled exceptional condition (CWE-703). Both the physical Appliance variant (prior to 5.36.00.16) and the virtual Application variant (prior to 5.36.00.00) are affected. The primary impact is loss of availability of the SCG service, meaning the gateway's security inspection or remote-support connectivity function is disrupted; no public exploit or active exploitation has been identified at time of analysis.
Unauthorized file upload in Lara Dashboard before 1.3.2 allows any authenticated account - regardless of content permissions - to reach the post-builder image and video upload endpoints. The pre-patch code derived the stored filename extension from the client-supplied value via `getClientOriginalExtension()`, enabling attackers to write polyglot files with arbitrary extensions (e.g., `.php`) into the public web root. On deployments where the web server executes the uploaded file type (e.g., PHP on a standard LAMP stack), this escalates to remote code execution. No public exploit identified at time of analysis; vendor-released patch v1.3.2 is confirmed.
Unauthorized correlation data exposure in MISP ≤2.5.45 allows authenticated users with restricted access to observe event correlations, event metadata, and feed URLs that their ACL would normally block. The freetext feed preview endpoint invoked two raw database queries against the Attribute model filtered only by attribute value and deletion status, entirely bypassing MISP's multi-layered access controls covering event distribution, organization membership, sharing groups, and attribute- and object-level permissions. A second sub-issue in the same code path leaked cross-feed correlation results and configured feed URLs for feeds not marked as lookup-visible. No public exploit or KEV listing exists at time of analysis.
Authorization bypass in ILIAS e-learning platform allows authenticated group members with only read access to modify group map settings and didactic template assignments via crafted POST requests to saveMapSettingsObject() and updateGroupTypeObject() in ilObjGroupGUI, changing group modes and effective permissions for all members. Versions 9.x before 9.23, 10.x before 10.11, and 11.x before 11.4 are confirmed affected per EUVD-2026-72363. No public exploit code has been identified at time of analysis, but the published patch commit reveals the exact missing permission gate, substantially lowering the reconstruction barrier for exploitation.
Authenticated users in MISP ≤2.5.45 can retrieve object-reference records outside their authorized scope via an Insecure Direct Object Reference (IDOR) flaw in EventGraphTool::get_reference_data(). The vulnerable code queried ObjectReference by UUID and returned the matching row without verifying the requesting user has access to the parent object the reference belongs to. An authenticated attacker who knows or enumerates a reference UUID can access reference metadata - including relationship types, comments, and referenced UUIDs - from objects in events they are not permitted to view. No public exploit or CISA KEV entry exists at time of analysis.
Unauthenticated deletion of arbitrary student course progress records is possible in the Masteriyo LMS WordPress plugin through version 2.2.0. The `delete_item_permissions_check` function in the `CourseProgressItemsController` REST API controller omits any WordPress capability check, allowing any unauthenticated network attacker to permanently erase course progress belonging to any enrolled student. No public exploit has been identified and the vulnerability is absent from CISA KEV, but the trivial exploitation conditions (PR:N, AV:N, AC:L) make remediation a clear priority for any site running this plugin.
Authenticated information disclosure in MISP ≤2.5.45 allows any logged-in user to bypass email-address redaction by switching from the HTML interface to the REST/JSON representation of DashboardsController::listTemplates(). The query always fetched User.email columns, but the redaction logic only executed inside the non-REST rendering branch - meaning the same session that saw blank email fields in the browser received raw email addresses when requesting JSON. The fix, contributed by CIRCL (MISP's primary maintainer) and released in commit fd554c3bd, centralizes the privilege decision in a new User::canSeeEmails() static helper, conditioning email retrieval on site-admin role or the Security.disclose_user_emails instance setting.