CVE-2026-69082 is a CSRF vulnerability in CTI-Transmute affecting the administrative user deletion functionality. The vulnerable endpoint /account/delete/<id> accepts HTTP GET requests that modify application state, enabling an unauthenticated attacker to craft malicious links that cause an authenticated administrator's browser to send unintended deletion requests. Since the browser includes the administrator's session credentials automatically, the attacker can delete arbitrary user accounts without authentication or direct interaction beyond the administrator visiting the malicious content. The vulnerability impacts versions up to and including 1.4.0. The patch fixes the issue by enforcing HTTP POST requests and requiring a CSRF token in the deletion form to prevent unauthorized requests.

An attacker can cause unauthorized deletion of user accounts by exploiting this CSRF vulnerability, leading to denial of access for affected users. If administrators can delete other administrators or the last administrative account, exploitation could disrupt or disable administration of the CTI-Transmute instance. The vulnerability allows modification of application state without authentication, relying solely on the victim administrator's active session and permissions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described fix involves restricting the deletion endpoint to HTTP POST requests and requiring a CSRF token in the deletion form. Until an official patch is available, administrators should avoid clicking untrusted links while authenticated and consider additional protective measures such as web application firewalls or disabling user deletion via GET requests if possible.