An information disclosure vulnerability exists in the AuthKey edit feature of the MISP platform. When an AuthKey update fails validation, the dropdown of available users is populated using the user_id field from the request payload, which an attacker can control. This flaw allows an authenticated user who has permission to edit AuthKey entries to submit arbitrary user IDs and see the resulting dropdown data, directly revealing the email addresses of all users.

Affect any deployment of the MISP platform (misp:misp) that uses the AuthKey edit endpoint. No specific affected versions are listed, so installations in all released versions are potentially vulnerable until the fix is applied.

The CVSS score of 5.3 indicates moderate severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated user with permission to edit AuthKey entries, limiting the attacker’s ability to enumerate users. Nevertheless, the revealed email addresses may facilitate further social engineering or targeted attacks.