MISP cti-transmute CVE-2026-72759

Exploitation requires at minimum the ability to issue requests to the conversion-history details endpoint, which the description's phrasing - 'a user able to request the corresponding history entry' and the code's use of current_user - suggests implies some form of application access, possibly an authenticated session; however, the CVSS 4.0 PR:N rating conflicts with this interpretation and authentication requirements are not definitively confirmed from available data. A necessary precondition is the existence of at least one history record that references a deleted conversion: if no conversions have been deleted in the target deployment, there is no exploitable state. No special platform, non-default configuration, or specific network topology is required beyond running an affected version (≤ 1.4.0). Exploitation is limited to reading historical input/output payloads - it does not enable write access or privilege escalation.

The vendor-provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N) scores 6.9, reflecting low-complexity network exploitation with only low confidentiality impact. Notably, the PR:N rating implies unauthenticated exploitation, but this conflicts with the description's language - 'a user able to request the corresponding history entry' and the code's reference to current_user - suggesting that some application-level access context is required; this discrepancy should be verified with CIRCL or MISP maintainers. The vulnerability is not listed in CISA KEV and no public POC has been identified, placing real-world exploitation probability in the low-to-moderate range. Impact is strictly limited to confidential disclosure of historical conversion input/output payloads; there is no integrity or availability impact. The net risk is meaningful for MISP deployments that delete conversions but retain history, and negligible in environments that never delete conversions or restrict the endpoint to highly trusted roles.

An attacker with application-level access to a cti-transmute instance sends a crafted request to the conversion-history details endpoint, specifying the ID of a history record associated with a previously deleted conversion. Because the conversion lookup returns None and the prior guard condition skips the visibility check, the endpoint returns the full retained input/output data of the deleted conversion. No public exploit code exists at time of analysis.