Is there a patch available for CVE-2026-54396?

Yes, a patch is available for CVE-2026-54396. Update the affected software to the latest version immediately.

MISP CVE-2026-54396

Q: What is the CVSS score of CVE-2026-54396?

CVE-2026-54396 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-36572 MEDIUM

Information Exposure (CWE-200)

2026-06-12 CIRCL

GHSA-xcgf-2j9f-cvgv

Information Disclosure Misp

5.3

CVSS 4.0 · Vendor: CIRCL

Severity by source

Vendor (CIRCL) PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.3 MEDIUM

Network-reachable POST endpoint with PR:L as AuthKey edit permission is required; confidentiality limited to email address enumeration with no integrity or availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (CIRCL).

CVSS VectorVendor: CIRCL

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jun 12, 2026 - 21:25 vuln.today

Analysis Generated

Jun 12, 2026 - 21:25 vuln.today

DescriptionCVE.org

An information disclosure vulnerability exists in the MISP AuthKey edit functionality. When a validation error occurs during an AuthKey edit request, the user dropdown was populated using the attacker-controlled AuthKey.user_id value from the submitted request data. An authenticated user with permission to edit an AuthKey could submit arbitrary user IDs and observe the returned dropdown data, allowing enumeration of user email addresses. The issue is fixed by deriving the dropdown user from the persisted AuthKey owner instead of the request body.

AnalysisAI

User email enumeration in MISP's AuthKey edit endpoint allows any authenticated user holding AuthKey-edit permission to discover the email addresses of arbitrary platform users by manipulating a single POST parameter. The flaw exists in the validation-error rendering path of AuthKeysController.php, where the user dropdown was populated from attacker-controlled request body data rather than the persisted AuthKey owner, enabling systematic iteration over numeric user IDs. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the attack is trivially reproducible from the description and patch diff alone.

Technical ContextAI

MISP (Malware Information Sharing Platform) is a CakePHP-based threat intelligence sharing platform used by CERTs, ISACs, and security teams. The affected component is the edit() action in app/Controller/AuthKeysController.php. The root cause is CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor): on a failed POST validation, the controller re-executed a user lookup using $this->request->data['AuthKey']['user_id'] - a fully attacker-controlled value - to populate the user dropdown. Because CakePHP re-renders the form on validation failure, the attacker receives the email address of whichever user ID they supplied. The fix, visible in commit 42737f4e88df801486334690913dd344e447fac3, replaces this with a fresh database query for the AuthKey's canonical owner column, severing the path from request input to the dropdown query. The CPE cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:* covers all MISP application versions, indicating no version range was excluded from the vulnerable codebase.

RemediationAI

The primary remediation is to update MISP to a version incorporating commit 42737f4e88df801486334690913dd344e447fac3, available at https://github.com/MISP/MISP/commit/42737f4e88df801486334690913dd344e447fac3. No specific patched release version number was confirmed in the available data - administrators running from source should pull and verify the fix is present in AuthKeysController.php; administrators using packaged releases should consult the MISP project's release notes for the corresponding tagged version. As a compensating control pending patch deployment, administrators should audit and restrict the AuthKey edit permission in MISP's role configuration to only the minimum set of users with a legitimate need to manage API keys. This reduces the exploitable population without eliminating the underlying flaw. No other workaround eliminates the vulnerability, as it is intrinsic to the controller's validation-error rendering path.