CVE-2026-72759: MISP cti-transmute Auth Bypass Vulnerability

CVE-2026-72759 Overview

CVE-2026-72759 is a missing authorization vulnerability [CWE-862] in MISP cti-transmute, an intelligence conversion tool used with the Malware Information Sharing Platform (MISP). The conversion-history details endpoint performs an incomplete authorization check when a history record references a deleted conversion. Because the lookup returns None for a deleted object, the prior code path skipped the visibility check entirely. Authenticated or unauthenticated network requesters able to reach a corresponding history entry could disclose the retained input and output payloads of deleted conversions.

Critical Impact
Information disclosure of retained conversion input/output data belonging to deleted records, bypassing the intended visibility controls of the cti-transmute history endpoint.

Affected Products

MISP cti-transmute — versions prior to the July 22, 2026 fix commit 88dc65f0117cf7a120f6252674c529e7b9c9b8c3
Deployments exposing the conversion-history details endpoint in website/web/conversions/conversions.py
MISP environments that retain historical conversion input/output after the underlying conversion object has been deleted

Discovery Timeline

2026-07-22 - Fix committed to the MISP cti-transmute repository
2026-08-10 - CVE-2026-72759 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-72759

Vulnerability Analysis

The vulnerability resides in the conversion-history details handler within website/web/conversions/conversions.py. The endpoint resolves a history record, then attempts to load the associated conversion object via conv_repo.get(conversion_history.conversion_id). When the referenced conversion has been deleted, the repository returns None. The original authorization guard only rejected the request when the object existed and the visibility check failed, leaving the deleted-object branch unprotected. The handler continued to return the history entry's stored input and output fields, disclosing content that should have been gated by the same visibility policy as the underlying conversion.

Root Cause

The root cause is a logic flaw in access control enforcement. The predicate if conversion_obj and not access.can_see(current_user, conversion_obj) treated a missing object as an implicit allow rather than an explicit deny. This is a classic missing authorization pattern [CWE-862], where the failure mode of a lookup was not treated as security-relevant.

Attack Vector

Exploitation requires network access to the cti-transmute web interface and knowledge of, or the ability to enumerate, a valid history_id whose referenced conversion has been deleted. The requester issues a standard details request against the conversion-history endpoint. The endpoint returns the retained input/output of the deleted conversion in its JSON response, without performing the visibility check that would otherwise apply.

python

         conversion_history = conv_repo.get_history(history_id)
         if conversion_history:
             conversion_obj = conv_repo.get(conversion_history.conversion_id)
-            if conversion_obj and not access.can_see(current_user, conversion_obj):
+            # A deleted conversion resolves to None; that must deny, not skip
+            # the visibility check, or the entry's input/output leaks.
+            if not conversion_obj or not access.can_see(current_user, conversion_obj):
                 return {"success": False, "message": "Forbidden", "toast_class": "danger"}, 403
             return {
                 "success": True,

Source: MISP/cti-transmute commit 88dc65f — the patch changes the guard to deny access whenever the conversion object is missing or the requester lacks permission.

Detection Methods for CVE-2026-72759

Indicators of Compromise

Successful HTTP 200 responses from the conversion-history details endpoint for history_id values whose conversion_id no longer resolves to an existing conversion
Response payloads containing conversion input/output fields returned to users who lack access.can_see permission on the referenced conversion
Repeated sequential or enumerated history_id requests from a single session, indicating history-record scraping

Detection Strategies

Correlate application logs of history-details requests against the conversion repository state to flag accesses where the referenced conversion is deleted
Add server-side audit logging inside the patched deny branch to record blocked attempts after applying the fix
Baseline normal history-details request volumes per user and alert on statistical outliers consistent with enumeration

Monitoring Recommendations

Monitor web server access logs for high-frequency requests to the /conversions/history/*/details route
Track application error and audit logs for 403 Forbidden responses originating from the patched authorization branch
Review database-level deletion events for conversion records and correlate with subsequent history-details lookups

How to Mitigate CVE-2026-72759

Immediate Actions Required

Update MISP cti-transmute to a build that includes commit 88dc65f0117cf7a120f6252674c529e7b9c9b8c3 or later
Restrict network access to the cti-transmute web interface to trusted analyst networks until the patch is deployed
Audit historical access logs for requests to the conversion-history details endpoint referencing deleted conversions

Patch Information

The fix is published in the MISP cti-transmute repository as commit 88dc65f0117cf7a120f6252674c529e7b9c9b8c3, dated July 22, 2026. The patch modifies the authorization guard in website/web/conversions/conversions.py so that a missing conversion object (returned when the record has been deleted) is treated as an explicit deny. Refer to the MISP cti-transmute commit reference for the full diff.

Workarounds

Apply the upstream patch directly to website/web/conversions/conversions.py if a full upgrade is not immediately feasible
Purge retained history entries whose associated conversion has been deleted to eliminate the disclosable data set
Place the cti-transmute web interface behind an authenticated reverse proxy that enforces IP allowlisting for the history-details route

bash

# Verify the patched commit is present in your deployment
cd /opt/cti-transmute
git log --oneline | grep 88dc65f

# If the fix commit is absent, fetch and apply the upstream fix
git fetch origin
git cherry-pick 88dc65f0117cf7a120f6252674c529e7b9c9b8c3
systemctl restart cti-transmute