Skip to main content

cti-transmute CVE-2026-73155

| EUVDEUVD-2026-55972 MEDIUM
Missing Authorization (CWE-862)
2026-08-11 CIRCL GHSA-rv36-q8cj-wgr9
Authentication Bypass Cti Transmute
5.3
CVSS 4.0 · Vendor: CIRCL
Share

Severity by source

Vendor (CIRCL) PRIMARY
5.3 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
4.3 MEDIUM

Network-accessible endpoint requiring authenticated low-privilege user; scope unchanged, no confidentiality impact, only limited integrity modification of reaction metadata.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (CIRCL).

CVSS VectorVendor: CIRCL

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

2
Source Code Evidence Fetched
Aug 11, 2026 - 08:21 vuln.today
Analysis Generated
Aug 11, 2026 - 08:21 vuln.today

DescriptionCVE.org

Affected versions of cti-transmute allow authenticated users to add or remove emoji reactions on comments without first checking whether those users are authorized to view the target comment.

The vulnerable react() handler passed an attacker-controlled comment_id directly to comments_repo.toggle_reaction() after only validating that the ID existed syntactically and that the requested emoji was permitted. Because comment-level visibility was not enforced, a user who could identify the ID of a private or otherwise inaccessible comment could modify reaction state on that comment despite lacking permission to access it.

The fix retrieves the target comment, rejects missing or deleted comments, retrieves its associated conversion, and enforces access.can_see_comment(current_user, comment, conversion). Unauthorized requests now receive HTTP 403.

AnalysisAI

Missing authorization in MISP cti-transmute (versions ≤ 1.4.0) allows any authenticated user to add or remove emoji reactions on comments they are not permitted to view by supplying an arbitrary comment_id to the react() handler. The handler validated syntactic ID format and emoji permissibility but never invoked the application's own access.can_see_comment() guard before calling comments_repo.toggle_reaction(), enabling unauthorized integrity modification of private comment metadata. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Authenticate with low-privilege account
Delivery
Enumerate or infer private comment IDs
Exploit
Craft reaction toggle request with target comment_id
Execution
react() handler skips access.can_see_comment() check
Persist
Reaction state modified on inaccessible comment
Impact
Unauthorized integrity modification confirmed via success response
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires a valid authenticated session (low-privilege user account) on a cti-transmute instance running version ≤ 1.4.0 - the CVSS 4.0 PR:L metric confirms authentication is mandatory. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N) yields a score of 5.3, consistent with a medium-severity issue. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An authenticated cti-transmute user with a low-privilege account submits a POST request to the react() endpoint with a comment_id corresponding to a private comment belonging to another organization or restricted conversion - IDs may be enumerable via sequential integers or exposed in other API responses. The handler validates the ID format and emoji, skips the access check, and applies the reaction, returning a success response despite the user having no view rights to that comment. …
Remediation Apply the upstream patch available at https://github.com/MISP/cti-transmute/commit/a18c07c3dd4a74b91ad8dd23d6e84fee4bcbd457, which adds comment existence validation, soft-delete rejection, and access.can_see_comment() enforcement in the react() handler. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Cti Transmute

View all
CVE-2026-69078 HIGH
8.8 Aug 03

Server-side request forgery in CTI-Transmute's evaluation report PDF-generation pipeline allows an attacker who can inje
CVE-2026-69082 HIGH
8.8 Aug 03

Cross-site request forgery in CTI-Transmute's administrative user deletion endpoint enables unauthenticated remote attac
CVE-2026-69079 HIGH
8.7 Aug 03

Uncontrolled resource consumption in CTI-Transmute's unauthenticated /activity_timeline endpoint allows remote attackers
CVE-2026-72759 MEDIUM
6.9 Aug 10

Unauthorized disclosure of deleted-conversion history data in MISP cti-transmute (≤ 1.4.0) stems from a logic inversion

CVE-2026-9806 MEDIUM
6.3 May 28

Stored XSS in MISP CTI Transmute's notification bell dropdown allows an attacker who can control convert names to inject
CVE-2026-73140 MEDIUM
5.3 Aug 11

Private evaluation comment disclosure in MISP's cti-transmute (all versions ≤ 1.4.0) allows any authenticated user with

CVE-2026-73162 MEDIUM
5.3 Aug 11

Cross-site request forgery in MISP cti-transmute exposes four authenticated account endpoints - /account/follow, /accoun
CVE-2026-72760 MEDIUM
5.3 Aug 10

Email address disclosure in MISP cti-transmute versions up to and including 1.4.0 exposes private user email addresses t
CVE-2026-71502 MEDIUM
5.1 Aug 06

Stored Vue template injection in CTI-Transmute ≤ 1.5.0 allows an unauthenticated attacker to execute arbitrary JavaScrip
CVE-2026-72751 MEDIUM
5.1 Aug 10

Stored cross-site scripting in CTI-Transmute's conversion graph allows attacker-controlled CTI content (MISP or STIX obj
CVE-2026-73158 MEDIUM
5.1 Aug 11

Stored cross-site scripting in MISP cti-transmute allows authenticated users to inject arbitrary script into shared grap
CVE-2026-73157 LOW
2.3 Aug 11

Cross-site scripting in cti-transmute's MISP event-browser allows a malicious or compromised remote MISP instance to inj

Same weakness CWE-862 – Missing Authorization

View all
CVE-2023-52163 HIGH POC
8.8
CVE-2025-6205 CRITICAL POC
9.1
CVE-2025-20362 HIGH POC
8.6
CVE-2017-9232 CRITICAL POC
9.8
CVE-2023-6875 CRITICAL POC
9.8
CVE-2024-4898 CRITICAL POC
9.8
CVE-2023-32117 CRITICAL POC
9.8
CVE-2020-36719 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

CVE-2026-73155 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy