cti-transmute EUVD-2026-55972

Exploitation requires a valid authenticated session (low-privilege user account) on a cti-transmute instance running version ≤ 1.4.0 - the CVSS 4.0 PR:L metric confirms authentication is mandatory. The attacker must know or enumerate a valid comment_id for a comment they are not authorized to view; comments that are hard-deleted do not trigger the vulnerability (FK constraint catches them), but soft-deleted or logically private comments are exploitable. No non-default configuration is required: the react() handler was present in default deployments. Exploitation is bounded by two limiting factors: (1) authentication - unauthenticated external actors cannot exploit this flaw, and (2) comment ID enumeration - the attacker must identify valid IDs for inaccessible comments, which may require a separate information disclosure vector. The impact is further limited to integrity of reaction metadata only; confidentiality of comment content is not breached via this endpoint.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N) yields a score of 5.3, consistent with a medium-severity issue. The network attack vector with low complexity and low privilege requirement means any authenticated cti-transmute user is a potential threat actor, which is a meaningful expansion of the attack surface beyond administrator-only exploits. Impact is strictly limited to integrity - specifically, the ability to corrupt emoji reaction metadata on private comments - with no confidentiality or availability consequence; an attacker cannot read comment content via this flaw. No EPSS score, CISA KEV listing, or public exploit code is referenced in any available source, meaning real-world exploitation has not been confirmed or publicly demonstrated. Practical risk is further bounded by the need to identify valid comment IDs for inaccessible comments, which may require separate enumeration effort. The product itself is a niche CTI conversion utility with limited enterprise deployment footprint, reducing the blast radius of any exploitation. Overall, this is a genuine authorization control gap warranting patching but not emergency escalation absent evidence of exploitation.

An authenticated cti-transmute user with a low-privilege account submits a POST request to the react() endpoint with a comment_id corresponding to a private comment belonging to another organization or restricted conversion - IDs may be enumerable via sequential integers or exposed in other API responses. The handler validates the ID format and emoji, skips the access check, and applies the reaction, returning a success response despite the user having no view rights to that comment. No public POC is known, but the attack requires only a valid session cookie and knowledge of a target comment ID.