CVE-2026-116748
HighCVSS 8.8Exploitation Probability (EPSS)
Elevated risk69th percentile - higher than 69% of all known CVEs
Summary
Transmission 4.0.0 before 4.1.3 contains a permissive CORS vulnerability in handle_request() in rpc-server.cc that exposes the X-Transmission-Session-Id anti-CSRF token to any web origin. Malicious web pages can read the token from the 409 handshake response and replay it to issue RPC calls, enabling script-torrent-done execution, download-dir changes, or torrent and data deletion.
Risk Assessment
A malicious website visited by a user can perform unauthorized RPC operations on the Transmission client, including data deletion or configuration changes. This may lead to data loss or compromise of system integrity.
Recommendation
Update Transmission to version 4.1.3 or later. Until updated, consider restricting access to the RPC interface (e.g., via authentication and origin restrictions) and avoid visiting untrusted sites while RPC is enabled.
Other vulnerabilities in Transmission
Original NVD description (English source)
Transmission 4.0.0 before 4.1.3 contains a permissive CORS vulnerability in handle_request() in rpc-server.cc that exposes the X-Transmission-Session-Id anti-CSRF token to any web origin. Malicious web pages can read the token from the 409 handshake response and replay it to issue RPC calls, enabling script-torrent-done execution, download-dir changes, or torrent and data deletion.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS