cti-transmute CVE-2026-73140

Exploitation requires a valid authenticated session with at least viewer-level access to a specific conversion object within the cti-transmute application (CVSS PR:L confirmed). The vulnerable pathway is triggered only when accessing the Markdown or PDF evaluation report export endpoints. Exploitation is limited to information disclosure - private evaluation comments and comment author names - with no write or availability impact. The flaw does not affect users who lack any access to the target conversion, and it does not bypass the conversion-level access gate, only the comment-level privacy rules within an export. Unauthenticated attackers cannot exploit this vulnerability.

The CVSS 4.0 score of 5.3 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N) appropriately reflects a network-exploitable, low-complexity flaw requiring only low-privilege authenticated access, with limited confidentiality impact. The SC:L (subsequent-system confidentiality) component in the vendor vector may account for the exposure of comment author identities, which are personal data with potential downstream privacy implications. No EPSS score was provided, and the absence of KEV listing and public exploit code suggests this has not been exploited at scale. However, the practical risk is non-trivial in threat intelligence sharing communities: cti-transmute is used in contexts where evaluation comments may contain sensitive analytical notes, attribution assessments, or personally identifying information about analysts, making confidentiality a meaningful concern even at CVSS Medium. The CVSS vector is consistent with the description - authenticated network access is required, and the impact is bounded to information disclosure with no integrity or availability component. No conflicts between data sources are apparent.

An authenticated user with viewer-level access to a conversion navigates to the evaluation report export endpoint and downloads the Markdown or PDF report. The exported document contains all evaluation comments, including private ones authored by other users or restricted to the conversion owner, along with each comment author's name - data the requesting user has no authorization to see. No exploit code or tooling is required beyond a standard authenticated HTTP request to the export endpoint.