CVE-2026-73155 cti-transmute Missing Authorization Allows Reactions to Private Comments
Authenticated users can modify reactions on private comments they cannot view, allowing unauthorized data modification in MISP cti-transmute.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-73155?
CVE-2026-73155 is a medium-severity missing authorization vulnerability in MISP cti-transmute, published on 11 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Affected versions of cti-transmute allow authenticated users to add or remove emoji reactions on comments without first checking whether those users are authorized to view the target comment.
The vulnerable react() handler passed an attacker-controlled comment_id directly to comments_repo.toggle_reaction() after only validating that the ID existed syntactically and that the requested emoji was permitted. Because comment-level visibility was not enforced, a user who could identify the ID of a private or otherwise inaccessible comment could modify reaction state on that comment despite lacking permission to access it.
The fix retrieves the target comment, rejects missing or deleted comments, retrieves its associated conversion, and enforces access.can_see_comment(current_user, comment, conversion). Unauthorized requests now receive HTTP 403.
Weakness: CWE-862
Which versions are affected by CVE-2026-73155?
How do I fix CVE-2026-73155?
No fix has been published for CVE-2026-73155 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-73155 being exploited?
There is no known exploitation of CVE-2026-73155 in the wild and no public exploit code.
Sources
Also known as GHSA-rv36-q8cj-wgr9.