Improper Authorization in cti-transmute Affects User Comment Reactions

CVE-2026-73155

What is CVE-2026-73155?

The cti-transmute application has a vulnerability allowing authenticated users to manipulate emoji reactions on comments without proper authorization checks. The vulnerable react() handler accepts an attacker-controlled comment_id without validating user permissions to view the comment, making it possible for unauthorized users to alter the reaction state of private or otherwise restricted comments. The fix ensures that access to comments is appropriately validated, rejecting unauthorized requests with appropriate HTTP status responses.

References