Misp Cti Transmute: Batch of 13 Vulnerabilities Includes SSRF and XSS Flaws

Key findings

Thirteen vulnerabilities disclosed for Misp Cti Transmute between August 8-11, 2026.
Includes a High-severity SSRF flaw (CVE-2026-73160) and multiple Medium-severity XSS vulnerabilities.
Flaws stem from improper handling of user-supplied data, leading to XSS, SSRF, and info disclosure.
Affected versions require urgent patching; consult vendor advisories for details.
Key vulnerabilities include CVE-2026-73162 (account ops), CVE-2026-73159/73158 (HTML injection), CVE-2026-72760 (email disclosure).

On August 11, 2026, a batch of thirteen vulnerabilities was disclosed for Misp's Cti Transmute, with the earliest disclosure on August 8th and the latest on August 11th. These vulnerabilities, ranging in severity from Low to High, primarily stem from improper handling of user-supplied data, leading to issues such as cross-site scripting (XSS), SSRF, and information disclosure. The most critical vulnerability, CVE-2026-73160, is a Server-Side Request Forgery (SSRF) flaw in the /fetch_misp_event and /misp_search_events endpoints.

Several vulnerabilities relate to cross-site scripting (XSS). CVE-2026-73159 and CVE-2026-73158 involve the interpolation of user-supplied icon values into HTML, potentially allowing attackers to inject malicious scripts. Similarly, CVE-2026-73157 and CVE-2026-73156 suffer from improper HTML escaping in the event-browser interface and ECharts tooltips, respectively, enabling XSS attacks through crafted data from remote MISP instances or STIX/MISP values. CVE-2026-72751 also presents a stored XSS vulnerability in the conversion graph visualization, while CVE-2026-71502 is a stored XSS flaw due to insufficient neutralization of Vue template expression delimiters in user-controlled data.

Other vulnerabilities include information disclosure and insecure direct object references. CVE-2026-73162 exposes several state-changing account operations as GET requests that require authentication but were improperly handled. CVE-2026-73161 involves improper handling of conversion-table values in the search highlighting feature, potentially leading to unintended HTML injection. CVE-2026-73155 allows authenticated users to add or remove emoji reactions on comments without proper authorization checks. CVE-2026-73140 fails to apply comment-level access-control rules during evaluation report exports. Lastly, CVE-2026-72760 discloses users' email addresses through the account following-list endpoint. CVE-2026-72759 involves an incomplete authorization check in the conversion-history details endpoint.

The disclosed vulnerabilities affect various versions of Cti Transmute. Users are advised to update to patched versions to mitigate these risks. The batch of vulnerabilities highlights the importance of robust input validation and proper output encoding when handling user-generated content, especially in applications that integrate with external data sources or display data to multiple users.

The timely disclosure and patching of these vulnerabilities are crucial for maintaining the security and integrity of systems utilizing Misp's Cti Transmute. Users should prioritize applying updates to protect against potential exploitation.

The vulnerabilities were disclosed between August 8 and August 11, 2026. The batch includes a high-severity SSRF vulnerability (CVE-2026-73160) and multiple medium-severity flaws, including several XSS vulnerabilities (CVE-2026-73159, CVE-2026-73158, CVE-2026-73157, CVE-2026-73156, CVE-2026-72751, CVE-2026-71502), an information disclosure (CVE-2026-72760), and issues with account operations and access control (CVE-2026-73162, CVE-2026-73155, CVE-2026-73140, CVE-2026-72759). CVE-2026-73161 relates to improper handling of search highlighting.

The primary impact of these vulnerabilities ranges from unauthorized information disclosure and potential script execution via XSS to more severe issues like SSRF, which could allow attackers to interact with internal systems or external resources. The improper handling of account operations and comment reactions could lead to unauthorized actions.

Users of Misp's Cti Transmute should consult the vendor's security advisories for specific version information and patching instructions. Applying available updates is the primary mitigation strategy.

This batch of vulnerabilities underscores the need for continuous security vigilance and prompt patching of software components, especially those handling diverse data inputs and user interactions.

The vulnerabilities were disclosed in close succession, highlighting a significant security event for Misp's Cti Transmute users. The range of issues, from XSS to SSRF, necessitates prompt attention from administrators.

The batch includes a high-severity SSRF vulnerability (CVE-2026-73160) and multiple medium-severity flaws. These include several XSS vulnerabilities (CVE-2026-73159, CVE-2026-73158, CVE-2026-73157, CVE-2026-73156, CVE-2026-72751, CVE-2026-71502), an information disclosure (CVE-2026-72760), and issues with account operations and access control (CVE-2026-73162, CVE-2026-73155, CVE-2026-73140, CVE-2026-72759). CVE-2026-73161 relates to improper handling of search highlighting.

The vulnerabilities affect various versions of Cti Transmute. Users are advised to update to patched versions to mitigate these risks. The batch of vulnerabilities highlights the importance of robust input validation and proper output encoding when handling user-generated content.

The batch of thirteen vulnerabilities disclosed for Misp's Cti Transmute between August 8 and August 11, 2026, presents a significant security concern. The vulnerabilities range from low to high severity, with a notable SSRF flaw (CVE-2026-73160) and multiple XSS vulnerabilities (including CVE-2026-73159, CVE-2026-73158, CVE-2026-73157, CVE-2026-73156, CVE-2026-72751, and CVE-2026-71502). Other issues include information disclosure (CVE-2026-72760), improper handling of account operations (CVE-2026-73162), and authorization bypasses (CVE-2026-73155, CVE-2026-73140, CVE-2026-72759). CVE-2026-73161 addresses a search highlighting vulnerability.

The vulnerabilities impact various versions of Cti Transmute, and users are strongly urged to update to the latest patched versions to mitigate these risks. The common theme across many of these flaws is the insufficient validation and sanitization of user-supplied data, leading to potential script injection and unauthorized access to sensitive information or system functionalities.

Administrators should consult Misp's official security advisories for detailed information on affected versions and the specific patches available. Prompt application of these updates is critical to prevent exploitation and maintain the security posture of their Cti Transmute instances. The disclosure of this batch underscores the ongoing need for diligent security practices and regular software updates in the cybersecurity landscape.