CVE-2026-72759

In affected versions of MISP cti-transmute, the conversion-history details endpoint performs an incomplete authorization check. When a history record references a deleted conversion, the associated conversion lookup returns None. The previous logic only denied access when the conversion object existed and the visibility check failed. As a result, deleted conversions bypassed the authorization check and their retained history input/output could be disclosed to a user able to request the corresponding history entry. The July 22, 2026 commit changes the logic to deny access whenever the conversion is missing or the requester lacks permission

CVSS

No CVSS.

References

Link	Resource
https://github.com/MISP/cti-transmute/commit/88dc65f0117cf7a120f6252674c529e7b9c9b8c3

Configurations

No configuration.

History

23 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) En las versiones afectadas de MISP cti-transmute, el endpoint de detalles del historial de conversión realiza una verificación de autorización incompleta. Cuando un registro del historial hace referencia a una conversión eliminada, la búsqueda de conversión asociada devuelve None. La lógica anterior solo denegaba el acceso cuando el objeto de conversión existía y la verificación de visibilidad fallaba. Como resultado, las conversiones eliminadas eludían la verificación de autorización y su entrada/salida del historial retenido podría ser divulgada a un usuario capaz de solicitar la entrada de historial correspondiente. El commit del 22 de julio de 2026 cambia la lógica para denegar el acceso siempre que la conversión falte o el solicitante carezca de permiso.

Information

Published : 2026-08-10 15:17

Updated : 2026-10-24 15:10

NVD link : CVE-2026-72759

Mitre link : CVE-2026-72759

CVE.ORG link : CVE-2026-72759

JSON object : View

Products Affected

No product.

CWE

CWE-862

Missing Authorization

{"id": "CVE-2026-72759", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-72759", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-10T17:01:47.836772Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "affectedData": [{"repo": "https://github.com/MISP/cti-transmute", "vendor": "misp", "product": "cti-transmute", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.4.0"}], "defaultStatus": "unaffected"}]}], "published": "2026-08-10T15:17:44.520", "references": [{"url": "https://github.com/MISP/cti-transmute/commit/88dc65f0117cf7a120f6252674c529e7b9c9b8c3", "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "In affected versions of MISP cti-transmute, the conversion-history details endpoint performs an incomplete authorization check. When a history record references a deleted conversion, the associated conversion lookup returns None. The previous logic only denied access when the conversion object existed and the visibility check failed. As a result, deleted conversions bypassed the authorization check and their retained history input/output could be disclosed to a user able to request the corresponding history entry. The July 22, 2026 commit changes the logic to deny access whenever the conversion is missing or the requester lacks permission"}, {"lang": "es", "value": "En las versiones afectadas de MISP cti-transmute, el endpoint de detalles del historial de conversi\u00f3n realiza una verificaci\u00f3n de autorizaci\u00f3n incompleta. Cuando un registro del historial hace referencia a una conversi\u00f3n eliminada, la b\u00fasqueda de conversi\u00f3n asociada devuelve None. La l\u00f3gica anterior solo denegaba el acceso cuando el objeto de conversi\u00f3n exist\u00eda y la verificaci\u00f3n de visibilidad fallaba. Como resultado, las conversiones eliminadas elud\u00edan la verificaci\u00f3n de autorizaci\u00f3n y su entrada/salida del historial retenido podr\u00eda ser divulgada a un usuario capaz de solicitar la entrada de historial correspondiente. El commit del 22 de julio de 2026 cambia la l\u00f3gica para denegar el acceso siempre que la conversi\u00f3n falte o el solicitante carezca de permiso."}], "lastModified": "2026-10-24T15:10:00.190", "sourceIdentifier": "5a6e4751-2f3f-4070-9419-94fb35b644e8"}