CVE-2026-73155

Affected versions of cti-transmute allow authenticated users to add or remove emoji reactions on comments without first checking whether those users are authorized to view the target comment. The vulnerable react() handler passed an attacker-controlled comment_id directly to comments_repo.toggle_reaction() after only validating that the ID existed syntactically and that the requested emoji was permitted. Because comment-level visibility was not enforced, a user who could identify the ID of a private or otherwise inaccessible comment could modify reaction state on that comment despite lacking permission to access it. The fix retrieves the target comment, rejects missing or deleted comments, retrieves its associated conversion, and enforces access.can_see_comment(current_user, comment, conversion). Unauthorized requests now receive HTTP 403.

CVSS

No CVSS.

References

Link	Resource
https://github.com/MISP/cti-transmute/commit/a18c07c3dd4a74b91ad8dd23d6e84fee4bcbd457

Configurations

No configuration.

History

23 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) Las versiones afectadas de cti-transmute permiten a usuarios autenticados añadir o eliminar reacciones de emoji en comentarios sin verificar primero si esos usuarios están autorizados para ver el comentario objetivo. El gestor vulnerable react() pasó un comment_id controlado por el atacante directamente a comments_repo.toggle_reaction() después de solo validar que el ID existía sintácticamente y que el emoji solicitado estaba permitido. Debido a que la visibilidad a nivel de comentario no se aplicaba, un usuario que pudiera identificar el ID de un comentario privado o de otro modo inaccesible podría modificar el estado de reacción en ese comentario a pesar de carecer de permiso para acceder a él. La solución recupera el comentario objetivo, rechaza los comentarios faltantes o eliminados, recupera su conversión asociada y aplica access.can_see_comment(current_user, comment, conversion). Las solicitudes no autorizadas ahora reciben HTTP 403.

Information

Published : 2026-08-11 08:17

Updated : 2026-10-24 15:10

NVD link : CVE-2026-73155

Mitre link : CVE-2026-73155

CVE.ORG link : CVE-2026-73155

JSON object : View

Products Affected

No product.

CWE

CWE-862

Missing Authorization

{"id": "CVE-2026-73155", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-73155", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-11T13:13:52.666628Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "affectedData": [{"repo": "https://github.com/MISP/cti-transmute", "vendor": "MISP", "product": "cti-transmute", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.4.0"}], "defaultStatus": "unaffected"}]}], "published": "2026-08-11T08:17:21.183", "references": [{"url": "https://github.com/MISP/cti-transmute/commit/a18c07c3dd4a74b91ad8dd23d6e84fee4bcbd457", "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "Affected versions of cti-transmute allow authenticated users to add or remove emoji reactions on comments without first checking whether those users are authorized to view the target comment.\n\n\nThe vulnerable react() handler passed an attacker-controlled comment_id directly to comments_repo.toggle_reaction() after only validating that the ID existed syntactically and that the requested emoji was permitted. Because comment-level visibility was not enforced, a user who could identify the ID of a private or otherwise inaccessible comment could modify reaction state on that comment despite lacking permission to access it.\n\n\nThe fix retrieves the target comment, rejects missing or deleted comments, retrieves its associated conversion, and enforces access.can_see_comment(current_user, comment, conversion). Unauthorized requests now receive HTTP 403."}, {"lang": "es", "value": "Las versiones afectadas de cti-transmute permiten a usuarios autenticados a\u00f1adir o eliminar reacciones de emoji en comentarios sin verificar primero si esos usuarios est\u00e1n autorizados para ver el comentario objetivo.\n\nEl gestor vulnerable react() pas\u00f3 un comment_id controlado por el atacante directamente a comments_repo.toggle_reaction() despu\u00e9s de solo validar que el ID exist\u00eda sint\u00e1cticamente y que el emoji solicitado estaba permitido. Debido a que la visibilidad a nivel de comentario no se aplicaba, un usuario que pudiera identificar el ID de un comentario privado o de otro modo inaccesible podr\u00eda modificar el estado de reacci\u00f3n en ese comentario a pesar de carecer de permiso para acceder a \u00e9l.\n\nLa soluci\u00f3n recupera el comentario objetivo, rechaza los comentarios faltantes o eliminados, recupera su conversi\u00f3n asociada y aplica access.can_see_comment(current_user, comment, conversion). Las solicitudes no autorizadas ahora reciben HTTP 403."}], "lastModified": "2026-10-24T15:10:00.190", "sourceIdentifier": "5a6e4751-2f3f-4070-9419-94fb35b644e8"}