CVE-2026-72760

The CVSS 5.3 score for this email disclosure in MISP's get_following() endpoint obscures a more serious problem. The vulnerability isn't simply that email addresses are returned — it's that this endpoint is an outlier in MISP's API design. The platform was apparently refactored to exclude email from user listings elsewhere, but get_following() was missed in that cleanup, suggesting a gap in the PII audit process that may have left other endpoints similarly inconsistent. Treat authentication as the primary barrier is the deeper failure. MISP serves ISACs, sector-specific sharing groups, and cross-sector partnerships where membership itself signals organizational significance. Any authenticated participant can harvest email addresses from the entire membership — this is trivial to automate and requires no special privileges. The assumption that authenticated users won't target each other holds for social networks; it fails for threat-intelligence platforms where participants are high-value targets precisely because of their organizational roles. More critically, patching does not close this vulnerability in the way you'd expect. The exploit is data collection, not system compromise. An adversary who harvested emails during the window before this CVE was disclosed already has that intelligence — the patch closes the source code hole but not the data sink. You cannot revoke intelligence that has already circulated. There's also a relational dimension that standard vulnerability scoring cannot represent. MISP instances federate through sharing communities. An email harvested from Instance A maps to a defender who also participates in Instances B, C, and D through overlapping membership. The harvested data becomes a trust-relationship map of the defensive community, and that intelligence persists independent of any patch. Two questions demand attention from operators: first, audit your MISP instance's API surface for other endpoints that may return PII inconsistent with current privacy standards — this was likely not an isolated oversight. Second, reconsider whether 'authenticated user' should be a sufficient access boundary for email disclosure in a threat-sharing context, or whether instances need additional privacy controls for this class of data.

Reviewed through automated stages and approved by a human before publication.