The vulnerability in MISP cti-transmute (CVE-2026-73155) arises from missing authorization checks in the react() handler. Authenticated users can manipulate emoji reactions on comments by supplying a comment_id without verifying if they have permission to view that comment. The handler only validated the syntactic existence of the comment_id and emoji validity, but did not enforce comment-level visibility. The fix involves retrieving the target comment, rejecting missing or deleted comments, and enforcing access.can_see_comment(current_user, comment, conversion) to ensure only authorized users can modify reactions. Unauthorized attempts now receive HTTP 403 errors.

Authenticated users can modify emoji reactions on comments they are not authorized to view, potentially leading to unauthorized manipulation of comment metadata. This could affect the integrity of comment reactions in private or restricted contexts. There is no indication of privilege escalation or data disclosure beyond reaction state modification.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The fix involves enforcing authorization checks on comment visibility before allowing reaction modifications. Until an official fix is available, restrict authenticated user permissions or monitor for suspicious reaction changes if feasible.