MISP cti-transmute CVE-2026-72760

Exploitation requires a valid authenticated account on the cti-transmute platform with sufficient permissions to follow other user accounts - the CVSS 4.0 PR:L metric confirms low-privilege authentication is sufficient and no elevated role is needed. The attacker must have network access to the application's API. No special server-side configuration, non-default feature flag, or specific deployment mode is required; all standard cti-transmute deployments running version 1.4.0 or earlier are affected by default. Exploitation is bounded to information disclosure only: the attacker gains email addresses but cannot modify data, escalate privileges, or execute code. The practical impact is limited to platforms where user email addresses are treated as private - deployments where emails are already public gain no additional exposure.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N) accurately characterizes this as a low-complexity, network-reachable vulnerability requiring authenticated low-privilege access, with limited confidentiality impact and zero integrity or availability impact. The slight subsequent-system confidentiality notation (SC:L) is plausible given that harvested email addresses could enable downstream spear-phishing against CTI analysts. This vulnerability is not listed in the CISA KEV catalog, no public POC has been identified, and no EPSS score was provided in the available data - all signals point toward low active exploitation pressure. Real-world risk is contextually elevated for communities running cti-transmute as a threat intelligence sharing hub, where analyst email addresses are operationally sensitive and their exposure could facilitate targeted social engineering. This is a medium-priority remediation - warranting prompt patching but not emergency response - and the simplicity of the fix (a one-line removal) means deployment risk is minimal.

An attacker with a valid low-privilege account on a cti-transmute deployment iterates through user accounts by following each one, triggering a get_following() API call per follow action. Each response returns the followed user's email address in the JSON payload, allowing the attacker to silently compile a full directory of platform user email addresses. No exploit code is required beyond standard HTTP requests; the data is returned in the normal authenticated API flow.