CVE-2026-69082: CTI-Transmute CSRF Vulnerability

CVE-2026-69082 Overview

CVE-2026-69082 is a Cross-Site Request Forgery (CSRF) vulnerability in CTI-Transmute, a threat intelligence transformation web application maintained by the MISP project. The flaw resides in the administrative user deletion endpoint /account/delete/<id>, which accepted HTTP GET requests for a state-changing operation. An unauthenticated remote attacker can craft a malicious link or embedded resource that triggers deletion of arbitrary user accounts when an authenticated administrator visits the attacker-controlled content. The vulnerability is tracked as CWE-352: Cross-Site Request Forgery.

Critical Impact
Successful exploitation allows an unauthenticated attacker to delete arbitrary CTI-Transmute user accounts, including potentially other administrators, causing denial of access and disruption of administration of the affected instance.

Affected Products

MISP CTI-Transmute (versions prior to commit 4f0d051ec5f1d45894c26987d409411728b2d82c)
CTI-Transmute web interface /account/delete/<id> endpoint
Deployments exposing the CTI-Transmute administrative interface to authenticated administrators using standard browsers

Discovery Timeline

2026-08-03 - CVE-2026-69082 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-69082

Vulnerability Analysis

CTI-Transmute exposed the user deletion route with both GET and POST methods and did not require a CSRF token. Because HTTP GET is permitted for a state-changing operation, an attacker can trigger deletion by embedding the URL in an <img> tag, an anchor, or an iframe on any page a targeted administrator browses.

When the administrator loads the attacker-controlled content, the browser automatically attaches the administrator's session cookie to the outbound request. The Flask route handler then executes the deletion using the victim's authenticated session context. The attacker requires no CTI-Transmute account and no prior knowledge of internal state beyond the target user ID.

Depending on whether administrators can delete peer administrators or the final administrative account, an attacker can escalate impact from single-account denial of access to full loss of administrative control over the instance.

Root Cause

The root cause is a missing CSRF protection on a state-changing endpoint combined with acceptance of HTTP GET. The Flask route in website/web/account/account.py declared methods=['GET', 'POST'], and the front-end template rendered the deletion action as a plain <a> link rather than a form submission bound to a CSRF token.

Attack Vector

The attack is network-based and requires user interaction from a currently authenticated administrator. The attacker delivers a URL such as https://<victim-host>/account/delete/2 through phishing, a forum post, a comment field, or any page that renders external image or link content. The victim's browser issues the GET request with valid session credentials, and the server processes the deletion.

python

# Patch to website/web/account/account.py
# Source: https://github.com/MISP/cti-transmute/commit/4f0d051ec5f1d45894c26987d409411728b2d82c

-@account_blueprint.route("/delete/<int:id>", methods=['GET', "POST"])
+@account_blueprint.route("/delete/<int:id>", methods=["POST"])
 @login_required
 def delete_user(id) -> redirect:
     """Delete the user"""

The patch restricts the route to POST only. The corresponding template change replaces the anchor link with a form that submits a csrf_token hidden field:

text

-<a v-if="user" :href="`/account/delete/${user.id}`" class="btn btn-danger btn-sm">
-    <i class="fas fa-trash me-1"></i> Confirm delete
-</a>
+<form v-if="user" method="post" :action="`/account/delete/${user.id}`" style="display:inline;">
+    <input type="hidden" name="csrf_token" value="{{ csrf_token() }}">
+    <button type="submit" class="btn btn-danger btn-sm">
+        <i class="fas fa-trash me-1"></i> Confirm delete
+    </button>
+</form>

Source: GitHub CTI-Transmute commit 4f0d051

Detection Methods for CVE-2026-69082

Indicators of Compromise

HTTP GET requests to /account/delete/<id> in web server or reverse proxy access logs
Requests to /account/delete/<id> carrying an external Referer header pointing to untrusted domains
Unexpected user account deletion events in CTI-Transmute audit logs without a corresponding administrator-initiated workflow
Sudden loss of access reports from previously active CTI-Transmute users

Detection Strategies

Enable request-method logging on the reverse proxy and alert on any GET request matching the /account/delete/ path pattern
Correlate deletion events with the requesting client's User-Agent, Referer, and session origin to flag deletions initiated from third-party pages
Baseline the volume and cadence of legitimate user deletions and alert on deviations

Monitoring Recommendations

Forward CTI-Transmute application logs and reverse proxy access logs to a centralized SIEM for retention and correlation
Monitor authenticated administrator sessions for cross-origin activity patterns consistent with CSRF delivery
Alert on any deletion operation completing without a preceding authenticated form POST containing a valid CSRF token

How to Mitigate CVE-2026-69082

Immediate Actions Required

Update CTI-Transmute to a build that includes commit 4f0d051ec5f1d45894c26987d409411728b2d82c or later
Audit user and administrator accounts for unauthorized deletions and restore accounts from backup where required
Instruct administrators to log out of CTI-Transmute before browsing untrusted content until the patch is applied

Patch Information

The upstream fix is available in the MISP CTI-Transmute repository at commit 4f0d051ec5f1d45894c26987d409411728b2d82c. The patch restricts /account/delete/<int:id> to HTTP POST and submits the deletion through a form containing a csrf_token value validated server-side.

Workarounds

Place CTI-Transmute behind a reverse proxy configured to block HTTP GET requests to /account/delete/ paths until the patch is applied
Restrict administrative access to CTI-Transmute to a dedicated browser profile or session that is not used for general web browsing
Enforce SameSite=Strict on session cookies at the reverse proxy or application layer to reduce cross-site request delivery

bash

# Nginx snippet to block GET requests against the deletion endpoint
location ~ ^/account/delete/ {
    limit_except POST {
        deny all;
    }
    proxy_pass http://cti_transmute_upstream;
}