CVE-2026-69082
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
CTI-Transmute has a cross-site request forgery (CSRF) vulnerability in the user deletion functionality. The /account/delete/<id> endpoint accepted HTTP GET requests, allowing an unauthenticated attacker to trick an administrator into deleting an account without consent.
Risk Assessment
An attacker can delete arbitrary user accounts, including administrators, leading to unauthorized modification of application state and denial of access for users.
Recommendation
Apply the patch that restricts the deletion endpoint to HTTP POST requests and requires a CSRF token.
Other vulnerabilities in CTI-Transmute
See all- CVE-2026-73162Medium
Affected versions of MISP cti-transmute expose several state-changing account operations as GET requests, such as /account/follow, /account/delete_notification, /account/mark_notification_read, and /account/mark_all_read. These endpoints require authentication, but before the fix they could be invoked with simple GET requests, making them susceptible to cross-site request forgery. The patch converts the actions to POST or DELETE and updates the frontend to include an X-CSRFToken header.
- CVE-2026-73161Medium
Affected versions of cti-transmute improperly handle conversion-table values passed through the search highlighting feature. The highlight() function previously returned the underlying text directly when no search query was supplied, or performed a regex replacement that inserted <mark> tags without first escaping the original content. Because the resulting value is used by an HTML-rendering sink, malicious markup contained in conversion data could be interpreted as HTML rather than displayed as text. The fix introduces a shared highlightMatches() helper that first converts special characters such as <, >, &, and quotes into HTML entities.
- CVE-2026-73160High
Affected versions of cti-transmute contain an SSRF vulnerability in the /fetch_misp_event and /misp_search_events endpoints. The URL validation routine checked whether a supplied hostname was itself an IP literal and rejected private, loopback, link-local, or reserved IPs. However, ordinary domain names were accepted without resolving them first. An attacker could therefore use a hostname whose DNS record pointed to an internal address and cause the cti-transmute server to issue requests into its internal network. The fix resolves hostnames using socket.getaddrinfo(), checks that every resolved address is globally routable, and additionally places @login_required on both affected MISP fetch/search routes.
- CVE-2026-73159Medium
Affected versions of cti-transmute allow a tag's icon value to be stored and later interpolated into HTML through Vue's v-html. The helper mapIcon() previously constructed an HTML string directly from the icon value, e.g., <i class="fas fa-${name}"></i>. Because the icon is user-supplied, a crafted value could break out of the intended markup and inject attacker-controlled HTML. When the affected tag was later rendered, including on the administrative triage interface, the payload could execute in the viewer's browser. The patch mitigates the issue at multiple layers: v-html is replaced with Vue :class binding, mapIcon() now returns only a constrained FontAwesome class string, and the backend validates icons against the FontAwesome catalogue or a strict [a-z0-9-]{1,40} slug pattern before storing them.
- CVE-2026-73158Medium
Affected versions of cti-transmute insufficiently validate saved graph configuration data. Graph configurations can contain style properties that are later consumed by Pivotick, and Pivotick interprets svgIcon as HTML. Because saved configurations may be created by one user and later displayed to other users—including administrators—a malicious user could store a crafted svgIcon value that executes script in another viewer’s browser. The fix introduces a strict configuration schema on both the server and client, rejecting dangerous properties such as svgIcon and iconClass.
- CVE-2026-73157Low
The vulnerability in cti-transmute renders data from a remote MISP instance into the event-browser interface using HTML interpolation. A malicious or compromised MISP server can return crafted values that inject HTML or script-capable content into the interface.
- CVE-2026-73156Medium
Affected versions of cti-transmute fail to HTML-escape attacker-controlled values used in ECharts Sunburst and Treemap tooltip formatters. Slice names may originate directly from STIX or MISP data, including STIX types, relationship_type, pattern prefixes, and MISP category/type values. Since ECharts interprets the formatter return value as HTML, crafted values can inject markup or script-capable content into the tooltip. The patch replaces direct interpolation with dedicated formatter functions that call escapeHtml() on p.name, p.data.value, and p.value.
- CVE-2026-73155Medium
Affected versions of cti-transmute allow authenticated users to add or remove emoji reactions on comments without first checking whether those users are authorized to view the target comment. The vulnerable react() handler passed an attacker-controlled comment_id directly to comments_repo.toggle_reaction() after only validating that the ID existed syntactically and that the requested emoji was permitted. Because comment-level visibility was not enforced, a user who could identify the ID of a private or otherwise inaccessible comment could modify reaction state on that comment despite lacking permission to access it. The fix retrieves the target comment, rejects missing or deleted comments, retrieves its associated conversion, and enforces access.can_see_comment(). Unauthorized requests now receive HTTP 403.
- CVE-2026-73140Medium
A vulnerability in cti-transmute causes evaluation report exports to not apply comment-level access control rules. A user authorized to view a conversion can export a report containing private evaluation comments that should only be visible to the owner, author, or administrator. The fix passes the requesting user into the report builder and filters comments through the authorization function.
- CVE-2026-72751Medium
CTI-Transmute is affected by a stored cross-site scripting (XSS) vulnerability in the conversion graph used to visualise converted MISP and STIX content. Attacker-controlled values from converted CTI data were passed to HTML-parsing sinks without sufficient neutralisation, allowing malicious markup execution. The issue affects node labels, edge labels, properties, and the raw JSON viewer.
Original NVD description (English source)
CTI-Transmute contained a cross-site request forgery vulnerability in the administrative user deletion functionality. The /account/delete/<id> endpoint accepted HTTP GET requests for an operation that modified application state. An unauthenticated remote attacker could construct a malicious link or embed a request targeting this endpoint and induce an authenticated CTI-Transmute administrator to visit the attacker-controlled content. If the administrator had an active session, the browser would automatically include the administrator’s session credentials, causing the selected user account to be deleted without the administrator intentionally confirming the operation. Successful exploitation requires interaction from a currently authenticated administrator who has permission to delete users. The attacker does not need a CTI-Transmute account or administrative privileges because the forged request executes using the victim administrator’s session. The vulnerability could allow an attacker to delete arbitrary user accounts, resulting in unauthorized modification of application state and denial of access for affected users. Depending on whether administrators can delete other administrators or the final administrative account, exploitation could also disrupt administration of the CTI-Transmute instance. The patch resolves the issue by restricting the deletion endpoint to HTTP POST requests and submitting the deletion through a form containing a CSRF token.