CVE-2026-38978 identifies a clickjacking weakness in Transmission's WebUI and RPC response paths in versions up to 4.1.1. This vulnerability allows an attacker to overlay or trick users into clicking on concealed UI elements, potentially leading to unintended actions. The vulnerability is categorized under CWE-113, indicating improper handling of HTTP headers that facilitate clickjacking. The CVSS score of 5.3 indicates a medium severity with no confidentiality or availability impact but with integrity impact. There is no vendor advisory or patch information available at this time, and the vulnerability is not related to a cloud service.

The vulnerability could allow an attacker to perform clickjacking attacks against users of Transmission's WebUI and RPC interfaces, potentially causing unintended commands or actions to be executed. The CVSS vector indicates no confidentiality or availability impact, but there is an integrity impact. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider mitigating clickjacking risks by using browser security features such as frame busting or Content Security Policy (CSP) frame-ancestors directives where possible. No official fix or temporary workaround has been published by the vendor at this time.