Transmission CVE-2026-116748

Requires the Transmission RPC/web server (default port 9091) to be reachable from the victim's browser, and the victim must actively visit an attacker-controlled web page (CVSS UI:P) while Transmission is running. The core token-leak works against any affected 4.0.0-4.1.2 instance because the server unconditionally sent 'Access-Control-Allow-Origin: *' and exposed X-Transmission-Session-Id. LIMITING factors: the leaked token only defeats the anti-CSRF check, so an RPC password ('rpc_authentication_required' + 'rpc_password') or an enabled IP whitelist ('rpc_whitelist_enabled') blocks the replay - the patch adds an explicit warning precisely for the no-password, whitelist-disabled configuration. Escalation to code execution additionally requires that the attacker can set download-dir and script-torrent-done, i.e. the 'done' script feature is usable; without it, impact is limited to settings tampering and torrent/data deletion.

This is a credible, verifiable CORS-misconfiguration flaw (CWE-942) with multiple corroborating signals. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) describes a network-reachable, low-complexity attack that still requires passive user interaction - the victim must visit an attacker-controlled web page. The vendor-supplied vector claims high confidentiality, integrity and availability impact (VC:H/VI:H/VA:H), consistent with the described outcomes: token theft, download-dir modification, script-torrent-done execution (code execution), and torrent/data deletion. Exploitation signals diverge in a way worth noting: EPSS is low-to-moderate at 0.53% (44th percentile), the vulnerability is NOT in CISA KEV, and the priority Decision label is 'this_week' rather than act_now/emergency. The source-code diff confirms the mechanism - handle_request() sent 'Access-Control-Allow-Origin: *' plus 'Access-Control-Expose-Headers: X-Transmission-Session-Id', letting any origin read the anti-CSRF token from the 409 handshake - so the root cause is confirmed, not inferred. One important caveat: PR:N and the full RCE chain assume the RPC server is reachable by the browser and, critically, that no RPC password is set, since the exposed token only defeats the anti-CSRF control, not password authentication; the patch itself adds a warning for the 'no password + whitelist disabled' configuration, implying the worst-case impact is config-dependent. Net: a real priority to patch this week, but not an in-the-wild emergency on current evidence.

A user running Transmission with its web RPC interface reachable (commonly bound to localhost:9091) visits a malicious or compromised web page. Because the server returned 'Access-Control-Allow-Origin: *' and exposed the session-ID header, the page's JavaScript reads the X-Transmission-Session-Id token from the 409 handshake response, then replays it to issue authenticated-looking RPC calls - changing download-dir and script-torrent-done to achieve drive-by code execution, or deleting torrents and data. A public PoC reference exists (joshua.hu writeup); it is not verified as working exploit code.