A flaw in MISP’s DashboardsController::listTemplates() allows any authenticated user to retrieve template owner email addresses through the REST/JSON interface, even though email redaction occurs only in the non‑REST rendering code. The vulnerability arises from an inconsistent enforcement of privacy checks, resulting in the exposure of sensitive contact data that should be limited to site administrators or enabled by the Security.disclose_user_emails setting. This constitutes an information‑disclosure weakness (CWE-200) with an improper authorization component (CWE-862).

The issue affects MISP installations running version 2.5.45 and earlier. All older releases expose user email addresses in the REST endpoint despite the interface‑level redaction.

The overall severity is a moderate CVSS score of 5.3, with no EPSS data available and no inclusion in the CISA KEV catalog. Exploitation requires only that an attacker gains authenticated access to the MISP instance and performs a standard REST request to the listTemplates endpoint. Because any logged‑in user can trigger the vulnerable code, the threat remains present in environments where non‑administrator roles are common.