CVE-2026-73140
Received Received - Intake

Information Disclosure in cti-transmute Evaluation Reports

Publication date: 2026-08-11

Last updated on: 2026-08-11

Assigner: 5a6e4751-2f3f-4070-9419-94fb35b644e8

Description
Affected versions of cti-transmute fail to apply comment-level access-control rules when generating evaluation report exports. Although normal comment retrieval filters comments according to conversion visibility, comment privacy, ownership, authorship, and administrative privileges, build_evaluation_report() previously included all evaluation comments without applying those rules. Consequently, a user who was authorized to view a conversion could export its evaluation report as Markdown or PDF and obtain private evaluation comments that should only have been visible to the conversion owner, the comment author, or an administrator. The leaked report data also contained the comment author's name. The fix passes the requesting user into the report builder and filters every evaluation comment using the shared access.can_see_comment() authorization function.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-11
Last Modified
2026-08-11
Generated
2026-08-11
AI Q&A
2026-08-11
EPSS Evaluated
N/A
NVD
CVE-2026-73140
EUVD
EUVD-2026-55970

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
misp cti-transmute *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the cti-transmute project where private evaluation comments and their authors' names were exposed in exported reports (Markdown or PDF). The issue occurred because the system failed to apply access-control rules during report generation, allowing users to view comments they were not authorized to see.

Detection Guidance

To detect this vulnerability, check if your cti-transmute system is running an affected version. Review evaluation report exports for private comments or author names that should not be visible. Compare export content with expected access permissions.

Impact Analysis

If you use cti-transmute, unauthorized users could access private comments in exported reports, potentially leaking sensitive information like internal discussions or user identities. This could lead to privacy breaches or compliance violations.

Compliance Impact

This vulnerability could violate GDPR or HIPAA by exposing private user data (comments and author names) without proper authorization. Organizations using cti-transmute may face legal penalties or reputational damage due to non-compliance with privacy regulations.

Mitigation Strategies

Apply the patch from the provided commit (5dbd19b39a61eab793586731f1a80d8c38907c42) to enforce comment visibility rules during report generation. Ensure the new can_see_comment function is properly integrated and used across all relevant modules.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73140. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart