MISP cti-transmute EUVD-2026-55994

The victim must have an active authenticated session on the cti-transmute instance at the time they visit the attacker-controlled page - unauthenticated users cannot be exploited since the endpoints require authentication. Exploitation is limited to four specific account operations: following a user, deleting a notification, marking a single notification read, and marking all notifications read; no higher-privilege actions (account deletion, data export, configuration changes) are reachable via this vector. The cti-transmute web instance must be reachable from the victim's browser (same network, or internet-facing), since the attack runs in the victim's browser context. SameSite cookie policy set to Strict would block this attack entirely; Lax would block it for most sub-resource requests but not top-level navigations. The CVSS UI:P confirms that victim interaction (visiting an attacker page) is a hard prerequisite - passive network interception cannot trigger this vulnerability.

The CVSS 4.0 score of 5.3 (Medium) is consistent with the actual impact envelope: the vulnerability requires authenticated victim interaction (UI:P) and produces only low integrity impact (VI:L) - account social actions rather than data theft or system compromise. No EPSS data was provided in the intelligence feed, and this CVE is absent from CISA KEV, meaning no confirmed active exploitation. The attack is technically trivial to execute (a single crafted webpage suffices) but operationally constrained: the attacker cannot force the victim to visit their page and cannot exfiltrate data. For a CTI-sharing platform, unauthorized follows represent a social engineering surface - an attacker could silently follow targeted analysts to monitor activity - which elevates the contextual risk slightly beyond the raw CVSS. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) accurately reflects that no special network positioning or configuration is required beyond inducing a page visit, and the absence of confidentiality impact (VC:N) is confirmed by the CSRF nature of the flaw, which cannot read responses cross-origin.

An attacker registers an account on the cti-transmute instance and identifies their user_id, then embeds JavaScript in a phishing email or compromised webpage that silently issues a POST (or, pre-patch, a GET) to /account/follow?user_id=ATTACKER_ID when an authenticated analyst visits. The victim's browser sends the request with their active session cookie, causing the platform to record a follow relationship without the analyst's awareness. No public exploit code has been identified, but the attack surface is trivially constructable from the public commit diff.