CVE-2026-73140: cti-transmute Information Disclosure Flaw

CVE-2026-73140 Overview

CVE-2026-73140 is a missing authorization vulnerability [CWE-862] in the MISP cti-transmute project. The build_evaluation_report() function generates Markdown and PDF evaluation report exports without applying comment-level access-control rules. While standard comment retrieval enforces conversion visibility, comment privacy, ownership, authorship, and administrator checks, the export path bypassed these filters entirely. Any user authorized to view a conversion could export its evaluation report and obtain private evaluation comments intended only for the conversion owner, the comment author, or an administrator. Leaked content also included the comment author's name.

Critical Impact
Authenticated users with view access to a conversion can exfiltrate private evaluation comments and author identity data through Markdown or PDF report exports.

Affected Products

MISP cti-transmute (website component)
build_evaluation_report() export function in the website module
Evaluation report Markdown and PDF export paths

Discovery Timeline

2026-08-11 - CVE-2026-73140 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-73140

Vulnerability Analysis

The vulnerability resides in the build_evaluation_report() function within the cti-transmute website module. Standard comment retrieval paths route reads through conversions_core and apply a shared visibility rule that considers whether the conversion is public, whether individual comments are marked private, and whether the requesting user is the conversion owner, comment author, or an administrator.

The report builder did not receive the requesting user context and did not invoke the visibility rule. As a result, every evaluation comment attached to a conversion was serialized into the export regardless of privacy state. The exports included the comment body and the author's display name, producing an information disclosure across the trust boundary between viewers and privileged reviewers.

Root Cause

The root cause is a missing authorization check [CWE-862] in an export code path that duplicated retrieval logic instead of routing through the shared access-control helper. Comment visibility enforcement was previously implemented as _can_see_comment inside conversions_core, but the export builder queried comments directly without consulting it.

The patch relocates the rule into website.lib.access.can_see_comment, threads the requesting user into the report builder, and filters every evaluation comment through the shared authorization function.

Attack Vector

An authenticated user with legitimate view access to a public conversion requests an evaluation report export in Markdown or PDF format. The server invokes the vulnerable build_evaluation_report() path, which enumerates all evaluation comments without applying privacy filters. Private comments authored by other users, including administrator notes, are returned in the downloadable artifact along with author names.

python

     return bool(conversion.public) or is_owner_or_admin(user, conversion)


+def can_see_comment(user, comment, conversion) -> bool:
+    """Visibility of one Comment: on a private Conversion only its owner or an
+    admin sees any comment; a private comment on a public Conversion is visible
+    only to the Conversion's owner, the comment's author, or an admin."""
+    if not conversion.public:
+        return is_owner_or_admin(user, conversion)
+    if not comment.is_private:
+        return True
+    return is_owner_or_admin(user, conversion) or is_owner(user, comment)
+
+
 def assert_can_refresh(user, conversion) -> None:
     """Allow only the Conversion's owner or an admin to refresh it.

Source: GitHub CTI Transmute Commit 5dbd19b

Detection Methods for CVE-2026-73140

Indicators of Compromise

Unexpected Markdown or PDF evaluation report downloads by non-privileged users on conversions that contain private comments.
Application logs showing calls to build_evaluation_report() from user sessions that do not own the target conversion.
Report artifacts containing comment content or author names that the requesting user has no legitimate need to view.

Detection Strategies

Audit web server access logs for evaluation report export endpoints and correlate with the requesting user's ownership and admin status.
Enable application-level logging on the report generation path to capture requester identity, conversion ID, and comment IDs included in each export.
Review historical exports produced before the patch to identify conversions whose private comments may have been exposed.

Monitoring Recommendations

Monitor for anomalous volumes of evaluation report exports, especially bulk downloads from a single user account.
Alert on export requests where the requesting user is neither the conversion owner nor an administrator and the target conversion has private comments.
Track failed authorization outcomes from access.can_see_comment() post-patch to identify probing behavior.

How to Mitigate CVE-2026-73140

Immediate Actions Required

Upgrade cti-transmute to the commit that introduces access.can_see_comment() and passes the requesting user into build_evaluation_report().
Rotate or review any private comment content that may have been exposed through pre-patch exports, particularly on public conversions with sensitive reviewer notes.
Restrict evaluation report export functionality to trusted user groups until the patch is deployed.

Patch Information

The fix is delivered in commit 5dbd19b39a61eab793586731f1a80d8c38907c42 in the MISP cti-transmute repository. The patch introduces can_see_comment() in website/lib/access.py, refactors website/repos/comments.py to consolidate write and visibility logic, and updates the report builder to filter every evaluation comment through the shared authorization function.

Workarounds

Disable the evaluation report export feature at the reverse proxy or application layer until the patched commit is deployed.
Mark all sensitive evaluation comments as belonging to private conversions so that the pre-patch export path is inaccessible to non-owners.
Apply web application firewall rules to block requests to the evaluation report export endpoint from users outside a defined admin group.

bash

# Example nginx rule to restrict evaluation report exports to authenticated admins
location ~ ^/conversions/[^/]+/evaluation_report\.(md|pdf)$ {
    auth_request /internal/admin_check;
    proxy_pass http://cti_transmute_backend;
}