In MISP cti-transmute versions <=1.4.0, the get_following() API endpoint returns the email address of followed users along with their name, user ID, and follow date. Since the email field is not required for the feature and is omitted in other related user lists, this behavior constitutes an unintended exposure of sensitive information to authenticated users. An attacker with valid authentication could exploit this by following multiple users and harvesting their email addresses. The fix involves removing the user.email field from the API response object.

Authenticated users can access email addresses of other users through the following-list endpoint, potentially leading to privacy violations and targeted phishing or spam campaigns. The exposure is limited to authenticated users and does not allow privilege escalation or direct system compromise. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict authenticated user access to the following-list endpoint or monitor usage patterns for suspicious activity. Avoid using affected versions in sensitive environments.