CVE-2026-73140: CWE-862 Missing Authorization in MISP cti-transmute
Affected versions of cti-transmute fail to apply comment-level access-control rules when generating evaluation report exports. Although normal comment retrieval filters comments according to conversion visibility, comment privacy, ownership, authorship, and administrative privileges, build_evaluation_report() previously included all evaluation comments without applying those rules. Consequently, a user who was authorized to view a conversion could export its evaluation report as Markdown or PDF and obtain private evaluation comments that should only have been visible to the conversion owner, the comment author, or an administrator. The leaked report data also contained the comment author's name. The fix passes the requesting user into the report builder and filters every evaluation comment using the shared access.can_see_comment() authorization function.
AI Analysis
Technical Summary
CVE-2026-73140 is a missing authorization vulnerability (CWE-862) in MISP's cti-transmute component affecting versions up to 1.4.0. The build_evaluation_report() function failed to apply comment-level access control rules when generating evaluation report exports, allowing users authorized to view a conversion to export reports containing private evaluation comments. These comments should have been restricted to the conversion owner, comment author, or administrators. The vulnerability exposes private comment content and author names. The fix involves passing the requesting user into the report builder and filtering comments using the shared access.can_see_comment() authorization function.
Potential Impact
Users with permission to view a conversion could export evaluation reports containing private comments that should have been restricted, leading to unauthorized disclosure of sensitive comment content and author identities. This compromises confidentiality of evaluation comments within the affected versions of cti-transmute.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability description indicates a fix was implemented by enforcing comment-level access controls in the report builder, but no official patch or advisory is provided. Until an official fix is available, restrict export permissions to trusted users only.
CVE-2026-73140: CWE-862 Missing Authorization in MISP cti-transmute
Description
Affected versions of cti-transmute fail to apply comment-level access-control rules when generating evaluation report exports. Although normal comment retrieval filters comments according to conversion visibility, comment privacy, ownership, authorship, and administrative privileges, build_evaluation_report() previously included all evaluation comments without applying those rules. Consequently, a user who was authorized to view a conversion could export its evaluation report as Markdown or PDF and obtain private evaluation comments that should only have been visible to the conversion owner, the comment author, or an administrator. The leaked report data also contained the comment author's name. The fix passes the requesting user into the report builder and filters every evaluation comment using the shared access.can_see_comment() authorization function.
CVSS v4.0
Score 5.3medium
Affected software
MISP
cti-transmute
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-73140 is a missing authorization vulnerability (CWE-862) in MISP's cti-transmute component affecting versions up to 1.4.0. The build_evaluation_report() function failed to apply comment-level access control rules when generating evaluation report exports, allowing users authorized to view a conversion to export reports containing private evaluation comments. These comments should have been restricted to the conversion owner, comment author, or administrators. The vulnerability exposes private comment content and author names. The fix involves passing the requesting user into the report builder and filtering comments using the shared access.can_see_comment() authorization function.
Potential Impact
Users with permission to view a conversion could export evaluation reports containing private comments that should have been restricted, leading to unauthorized disclosure of sensitive comment content and author identities. This compromises confidentiality of evaluation comments within the affected versions of cti-transmute.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability description indicates a fix was implemented by enforcing comment-level access controls in the report builder, but no official patch or advisory is provided. Until an official fix is available, restrict export permissions to trusted users only.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- CIRCL
- Date Reserved
- 2026-08-11T07:18:03.417Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a7ad257bf8831d5395884ae
Added to database: 08/11/2026, 07:42:15 UTC
Last enriched: 08/11/2026, 08:00:34 UTC
Last updated: 09/25/2026, 13:47:48 UTC
Views: 68
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.