CVE-2026-72759
Received Received - Intake

Information Disclosure in MISP cti-transmute History

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: 5a6e4751-2f3f-4070-9419-94fb35b644e8

Description
In affected versions of MISP cti-transmute, the conversion-history details endpoint performs an incomplete authorization check. When a history record references a deleted conversion, the associated conversion lookup returns None. The previous logic only denied access when the conversion object existed and the visibility check failed. As a result, deleted conversions bypassed the authorization check and their retained history input/output could be disclosed to a user able to request the corresponding history entry. The July 22, 2026 commit changes the logic to deny access whenever the conversion is missing or the requester lacks permission

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-72759
EUVD
EUVD-2026-55635

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability exists in MISP cti-transmute versions before the July 22, 2026 commit. The conversion-history details endpoint had an authorization flaw where deleted conversion records bypassed access checks. If a history entry referenced a deleted conversion, the system would return the history data without verifying permissions, potentially exposing sensitive input/output data to unauthorized users.

Impact Analysis

An attacker with access to the system could exploit this to view sensitive data from deleted conversion operations. This includes potentially confidential information processed in those conversions. The impact depends on what data was processed in the affected conversions.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR's data protection principles and HIPAA's security requirements. It may result in data breaches requiring breach notifications and potential regulatory penalties.

Mitigation Strategies

Update MISP cti-transmute to the version with the July 22, 2026 commit that fixes the authorization check logic. Review and restrict access to conversion-history details endpoints to prevent unauthorized disclosure of deleted conversion data.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72759. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart