Access Control Flaw in Evaluation Report Export for cti-transmute by MISP

CVE-2026-73140

What is CVE-2026-73140?

The cti-transmute application contains a significant access control vulnerability related to the export of evaluation reports. In affected versions, the system fails to enforce comment-level access control when generating report exports. While normal comment visibility is restricted based on various conditions such as ownership and administrative privileges, the function responsible for building evaluation reports did not apply these restrictions. As a result, users with authorization to view a conversion could obtain private comments by exporting evaluation reports in Markdown or PDF format. This flaw not only exposed sensitive information but also included the names of comment authors, potentially leading to privacy breaches. The newly implemented fix ensures that all comments are filtered according to the user's access rights during report generation.

References