CVE-2026-73155
Received Received - Intake

Authentication Bypass via Comment Reaction in cti-transmute

Publication date: 2026-08-11

Last updated on: 2026-08-11

Assigner: 5a6e4751-2f3f-4070-9419-94fb35b644e8

Description
Affected versions of cti-transmute allow authenticated users to add or remove emoji reactions on comments without first checking whether those users are authorized to view the target comment. The vulnerable react() handler passed an attacker-controlled comment_id directly to comments_repo.toggle_reaction() after only validating that the ID existed syntactically and that the requested emoji was permitted. Because comment-level visibility was not enforced, a user who could identify the ID of a private or otherwise inaccessible comment could modify reaction state on that comment despite lacking permission to access it. The fix retrieves the target comment, rejects missing or deleted comments, retrieves its associated conversion, and enforces access.can_see_comment(current_user, comment, conversion). Unauthorized requests now receive HTTP 403.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-11
Last Modified
2026-08-11
Generated
2026-08-11
AI Q&A
2026-08-11
EPSS Evaluated
N/A
NVD
CVE-2026-73155
EUVD
EUVD-2026-55972

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
misp cti-transmute to a18c07c3dd4a74b91ad8dd23d6e84fee4bcbd457 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in cti-transmute allows authenticated users to add or remove emoji reactions on comments without proper authorization checks. The system did not verify if users could view the target comment before allowing reactions, enabling unauthorized access to private comments.

Detection Guidance

This vulnerability can be detected by checking if unauthorized users can add or remove emoji reactions on private comments. Review logs for the react() function in cti-transmute to see if reactions are being modified on comments where the user lacks permission. Look for HTTP 403 errors in responses after the fix was applied.

Impact Analysis

An attacker could manipulate emoji reactions on private comments they cannot access, potentially exposing sensitive information or disrupting comment integrity. This could lead to unauthorized data exposure or misinformation.

Compliance Impact

This vulnerability may violate data protection regulations like GDPR or HIPAA by allowing unauthorized access to private comments, potentially exposing personal or sensitive data without consent.

Mitigation Strategies

Apply the patch from the commit a18c07c in the MISP/cti-transmute repository. Ensure the react() function validates comment existence, checks for deletion, and enforces user permissions before allowing reactions. Update to the latest version of cti-transmute.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73155. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart