"new users" dashboard widget leaks full user data, including (old) authkeys and password hashes

Finding

The "new users" dashboard widget can be abused by any authenticated user to fetch full user data, including (old) authkeys and password hashes.

Impact

Depending on the use of old authkeys or advanced authkeys: - Leak of password hashes - Access to all user authkeys (for instances using old authkeys) - For some older systems, initial site admin/user advanced authkeys were the old "authkey" (same as in db). I believe this was fixed recently, but I do not know if these authkeys were also modified automatically after the update for existing systems. Systems that are not patched might still have that authkey for their initial site admin accounts if it was not modified. - Full list of local user's emails

Patches

MISP >= 2.5.39

Workarounds

Please note to also rotate your initial site admin authkey on older instances (MISP 2.5.32 and below).

References

https://vulnerability.circl.lu/vuln/gcve-1-2026-20069