CVE-2026-73155: cti-transmute Auth Bypass Vulnerability

CVE-2026-73155 Overview

CVE-2026-73155 is a missing authorization vulnerability [CWE-862] in MISP cti-transmute. The flaw exists in the react() handler that processes emoji reactions on comments. Authenticated users can add or remove reactions on comments they are not permitted to view. The handler passed an attacker-controlled comment_id directly to comments_repo.toggle_reaction() after validating only the ID syntax and emoji allow-list. Comment-level visibility checks were not performed. Any user who could discover or guess the ID of a private comment could modify its reaction state.

Critical Impact
Authenticated users can manipulate reaction state on private or otherwise inaccessible comments, breaking comment confidentiality boundaries and integrity of collaborative threat-intelligence workflows.

Affected Products

MISP cti-transmute (versions prior to commit a18c07c)
Deployments exposing the comment reaction endpoint to authenticated users
Instances relying on comment-level visibility for private conversion discussions

Discovery Timeline

2026-08-11 - CVE-2026-73155 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-73155

Vulnerability Analysis

The vulnerability resides in the emoji reaction handler in website/web/conversions/conversions.py. The react() function accepts comment_id and emoji parameters from authenticated users. The pre-patch code validated only that comment_id was non-empty and that emoji appeared in an allowed_emojis list. It then invoked comments_repo.toggle_reaction(comment_id, current_user.id, emoji) directly.

Because the handler never resolved the referenced comment nor called access.can_see_comment(), permission enforcement was skipped entirely. A user with a valid session could target any numeric comment identifier, including comments belonging to private conversions or restricted discussion threads. The result is unauthorized modification of reaction state, revealing the existence of hidden comments and polluting collaborative metadata.

Root Cause

The root cause is a missing function-level authorization check [CWE-862]. Input validation confirmed request well-formedness but not the caller's right to act on the target object. Deleted comments were also not filtered, so reaction state could be toggled on records that should be inaccessible.

Attack Vector

Exploitation requires an authenticated account and network access to the application. An attacker enumerates or guesses comment_id values, then issues a reaction toggle request with a permitted emoji. No user interaction from the victim is required, and no elevated privileges are needed.

python

     if not comment_id or emoji not in allowed_emojis:
         return {"success": False, "message": "Invalid request", "toast_class": "danger"}, 400
 
+    comment = comments_repo.get(comment_id)
+    if not comment or comment.is_deleted:
+        return {"success": False, "message": "Comment not found", "toast_class": "danger"}, 404
+    conversion = conv_repo.get(comment.conversion_id)
+    if not conversion or not access.can_see_comment(current_user, comment, conversion):
+        return {"success": False, "message": "Permission denied", "toast_class": "danger"}, 403
+
     try:
         added = comments_repo.toggle_reaction(comment_id, current_user.id, emoji)
-    except Exception:  # noqa: BLE001 - e.g. reacting to a deleted comment (FK)
+    except Exception:  # noqa: BLE001 - e.g. the comment hard-deleted mid-request (FK)
         db.session.rollback()
         return {"success": False, "message": "Failed to update reaction", "toast_class": "danger"}, 500

Source: GitHub Commit for CTI Transmute. The patch loads the target comment, rejects missing or deleted records with HTTP 404, resolves the parent conversion, and enforces access.can_see_comment(current_user, comment, conversion) before mutating state. Unauthorized callers now receive HTTP 403.

Detection Methods for CVE-2026-73155

Indicators of Compromise

HTTP POST requests to the reaction endpoint targeting sequential or enumerated comment_id values from a single authenticated session
Database rows in the reactions table referencing comment_id values belonging to conversions the reacting user cannot access
Application logs showing successful toggle_reaction calls followed by user visits to unrelated comment threads

Detection Strategies

Audit reaction records and cross-reference the reacting user's access rights against each comment's parent conversion
Instrument the pre-patch react() handler with authorization telemetry to identify historical unauthorized reactions
Alert on high-rate reaction toggling from a single account, which indicates comment ID enumeration

Monitoring Recommendations

Log all requests to /conversions reaction endpoints with user_id, comment_id, and response code for retrospective analysis
Monitor for HTTP 403 responses on the patched endpoint to detect ongoing enumeration attempts
Track new reaction inserts and validate them against access.can_see_comment() in an out-of-band job

How to Mitigate CVE-2026-73155

Immediate Actions Required

Upgrade cti-transmute to a build that includes commit a18c07c3dd4a74b91ad8dd23d6e84fee4bcbd457 or later
Review the reactions table for entries created by users lacking visibility to the associated comment and remove them
Rotate or review credentials for accounts that exhibited suspicious reaction activity prior to patching

Patch Information

The fix is available in the upstream repository via GitHub Commit for CTI Transmute. The patch adds a comment lookup, deleted-comment check, conversion resolution, and an explicit access.can_see_comment() gate before invoking comments_repo.toggle_reaction().

Workarounds

Restrict access to the reaction endpoint at the reverse proxy or WAF layer until the patch is deployed
Temporarily disable emoji reactions in the application configuration if operationally acceptable
Limit cti-transmute accounts to trusted internal users while the fix is being validated

bash

# Pull and deploy the patched cti-transmute revision
cd /opt/cti-transmute
git fetch origin
git checkout a18c07c3dd4a74b91ad8dd23d6e84fee4bcbd457
# Restart the application service
systemctl restart cti-transmute