CTI-Transmute CVE-2026-69082

Exploitation requires a currently authenticated CTI-Transmute administrator with user-deletion privileges to visit attacker-controlled content (a webpage or HTML email) while holding an active browser session. The attacker requires no CTI-Transmute account, no credentials, and no network access to the server beyond being able to deliver content to the victim's browser. The critical limiting factor is mandatory administrator interaction - no exploitation is possible without a privileged user being socially engineered into visiting the malicious content. The vulnerability is present in the default application configuration; no special server-side feature flag or non-default setting is required. Exploitation scope is bounded by the victim's session: the attacker can only delete accounts that the administrator's own permissions allow, and only as long as the administrator's session remains valid.

The provided CVSS 4.0 score of 8.8 with metrics AV:N/AC:L/AT:N/PR:N/UI:N is internally inconsistent with the vulnerability class: CSRF by definition requires user interaction (an authenticated victim must follow a crafted request), making UI:N incorrect - UI:P (passive) is the appropriate CVSS 4.0 value. This discrepancy likely inflates the score and should be verified with CIRCL. Correcting for UI:P would reduce the rating. No EPSS data was provided and no KEV listing was present, indicating no confirmed active exploitation at time of analysis. The VC:H metric in the provided vector (implying high confidentiality impact) is also inconsistent with the described impact - the vulnerability enables account deletion, which is an integrity impact, not a confidentiality breach. Real-world risk is moderate: exploitation requires social engineering a privileged administrator and is therefore not mass-exploitable or automatable, but the consequence of deleting the sole administrator account could cause a full administrative lockout of a CTI-Transmute instance.

An attacker targeting a CTI-Transmute instance enumerates or guesses user account IDs through the application's admin interface or API, then embeds an invisible image tag or iframe in a phishing email pointing to the target instance's /account/delete/<id> endpoint. When a CTI-Transmute administrator with an active session opens the email or visits the attacker-controlled page, their browser silently issues a GET request to the deletion endpoint with the administrator's session cookie attached, causing the targeted account to be permanently deleted without any confirmation prompt. No public exploit code has been identified at time of analysis, though the attack is trivial to reproduce given the simple GET-based trigger.