EUVD-2026-55635
GHSA-9p5q-96wv-4xvh
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Description implies current_user context and user-gated endpoint access, supporting PR:L; impact is limited to low confidentiality with no integrity or availability effect.
Primary rating from Vendor (CIRCL).
CVSS VectorVendor: CIRCL
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
In affected versions of MISP cti-transmute, the conversion-history details endpoint performs an incomplete authorization check. When a history record references a deleted conversion, the associated conversion lookup returns None. The previous logic only denied access when the conversion object existed and the visibility check failed. As a result, deleted conversions bypassed the authorization check and their retained history input/output could be disclosed to a user able to request the corresponding history entry. The July 22, 2026 commit changes the logic to deny access whenever the conversion is missing or the requester lacks permission
AnalysisAI
Unauthorized disclosure of deleted-conversion history data in MISP cti-transmute (≤ 1.4.0) stems from a logic inversion in the conversion-history details endpoint that allows the authorization check to be silently bypassed. When a history record references a deleted conversion, the lookup returns None, and the prior condition only enforced visibility when the conversion object existed - meaning None short-circuited the check and granted access. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires at minimum the ability to issue requests to the conversion-history details endpoint, which the description's phrasing - 'a user able to request the corresponding history entry' and the code's use of current_user - suggests implies some form of application access, possibly an authenticated session; however, the CVSS 4.0 PR:N rating conflicts with this interpretation and authentication requirements are not definitively confirmed from available data. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N) scores 6.9, reflecting low-complexity network exploitation with only low confidentiality impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with application-level access to a cti-transmute instance sends a crafted request to the conversion-history details endpoint, specifying the ID of a history record associated with a previously deleted conversion. Because the conversion lookup returns None and the prior guard condition skips the visibility check, the endpoint returns the full retained input/output data of the deleted conversion. … |
| Remediation | The primary remediation is to update cti-transmute to a release that incorporates commit 88dc65f0117cf7a120f6252674c529e7b9c9b8c3 (https://github.com/MISP/cti-transmute/commit/88dc65f0117cf7a120f6252674c529e7b9c9b8c3); since an exact tagged release version post-patch has not been confirmed, operators should verify that the installed version includes this commit before considering remediation complete. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Cti Transmute
View allServer-side request forgery in CTI-Transmute's evaluation report PDF-generation pipeline allows an attacker who can inje
Cross-site request forgery in CTI-Transmute's administrative user deletion endpoint enables unauthenticated remote attac
Uncontrolled resource consumption in CTI-Transmute's unauthenticated /activity_timeline endpoint allows remote attackers
Stored XSS in MISP CTI Transmute's notification bell dropdown allows an attacker who can control convert names to inject
Missing authorization in MISP cti-transmute (versions ≤ 1.4.0) allows any authenticated user to add or remove emoji reac
Private evaluation comment disclosure in MISP's cti-transmute (all versions ≤ 1.4.0) allows any authenticated user with
Cross-site request forgery in MISP cti-transmute exposes four authenticated account endpoints - /account/follow, /accoun
Email address disclosure in MISP cti-transmute versions up to and including 1.4.0 exposes private user email addresses t
Stored Vue template injection in CTI-Transmute ≤ 1.5.0 allows an unauthenticated attacker to execute arbitrary JavaScrip
Stored cross-site scripting in CTI-Transmute's conversion graph allows attacker-controlled CTI content (MISP or STIX obj
Stored cross-site scripting in MISP cti-transmute allows authenticated users to inject arbitrary script into shared grap
Cross-site scripting in cti-transmute's MISP event-browser allows a malicious or compromised remote MISP instance to inj
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today