A flaw in the MISP cti-transmute service causes the account following-list API to return the email addresses of followed users. The endpoint includes the user’s name, ID and follow date, but the email field is unnecessary for the following function. The disclosure of email addresses falls under CWE‑200, leading to a breach of user privacy and potential targetable data for malicious actors.

MISP cti-transmute in all released versions that have not applied the recent commit that removes the email field from the API response. Affected users must identify whether their installation still contains the legacy get_following() implementation.

The CVSS score of 5.3 indicates moderate severity. With no EPSS score available and no listing in CISA’s KEV catalog, the risk of exploitation is likely low to moderate, depending on user access levels. Based on the description, an attacker who can authenticate to the system can repeatedly issue following requests to harvest email addresses, implying the attack vector requires legitimate credentials but no additional privileges are needed beyond normal user access.