EUVD-2026-55970
GHSA-vrrh-vgmq-m54x
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable export endpoint requires low-privilege authenticated session; impact is limited to partial confidentiality loss with no integrity or availability component.
Primary rating from Vendor (CIRCL).
CVSS VectorVendor: CIRCL
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
Affected versions of cti-transmute fail to apply comment-level access-control rules when generating evaluation report exports. Although normal comment retrieval filters comments according to conversion visibility, comment privacy, ownership, authorship, and administrative privileges, build_evaluation_report() previously included all evaluation comments without applying those rules.
Consequently, a user who was authorized to view a conversion could export its evaluation report as Markdown or PDF and obtain private evaluation comments that should only have been visible to the conversion owner, the comment author, or an administrator. The leaked report data also contained the comment author's name. The fix passes the requesting user into the report builder and filters every evaluation comment using the shared access.can_see_comment() authorization function.
AnalysisAI
Private evaluation comment disclosure in MISP's cti-transmute (all versions ≤ 1.4.0) allows any authenticated user with viewer-level access to a conversion to export its evaluation report as Markdown or PDF and obtain private comments that should have been restricted to the conversion owner, comment author, or an administrator. The root cause is a missing authorization check in build_evaluation_report(), which bypassed the same access-control logic enforced by normal comment retrieval. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid authenticated session with at least viewer-level access to a specific conversion object within the cti-transmute application (CVSS PR:L confirmed). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 5.3 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N) appropriately reflects a network-exploitable, low-complexity flaw requiring only low-privilege authenticated access, with limited confidentiality impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated user with viewer-level access to a conversion navigates to the evaluation report export endpoint and downloads the Markdown or PDF report. The exported document contains all evaluation comments, including private ones authored by other users or restricted to the conversion owner, along with each comment author's name - data the requesting user has no authorization to see. … |
| Remediation | The primary remediation is to apply the upstream fix from commit 5dbd19b39a61eab793586731f1a80d8c38907c42 (https://github.com/MISP/cti-transmute/commit/5dbd19b39a61eab793586731f1a80d8c38907c42). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Cti Transmute
View allServer-side request forgery in CTI-Transmute's evaluation report PDF-generation pipeline allows an attacker who can inje
Cross-site request forgery in CTI-Transmute's administrative user deletion endpoint enables unauthenticated remote attac
Uncontrolled resource consumption in CTI-Transmute's unauthenticated /activity_timeline endpoint allows remote attackers
Unauthorized disclosure of deleted-conversion history data in MISP cti-transmute (≤ 1.4.0) stems from a logic inversion
Stored XSS in MISP CTI Transmute's notification bell dropdown allows an attacker who can control convert names to inject
Missing authorization in MISP cti-transmute (versions ≤ 1.4.0) allows any authenticated user to add or remove emoji reac
Cross-site request forgery in MISP cti-transmute exposes four authenticated account endpoints - /account/follow, /accoun
Email address disclosure in MISP cti-transmute versions up to and including 1.4.0 exposes private user email addresses t
Stored Vue template injection in CTI-Transmute ≤ 1.5.0 allows an unauthenticated attacker to execute arbitrary JavaScrip
Stored cross-site scripting in CTI-Transmute's conversion graph allows attacker-controlled CTI content (MISP or STIX obj
Stored cross-site scripting in MISP cti-transmute allows authenticated users to inject arbitrary script into shared grap
Cross-site scripting in cti-transmute's MISP event-browser allows a malicious or compromised remote MISP instance to inj
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today