CVE-2026-72759

In affected versions of MISP cti-transmute, the conversion-history details endpoint performs an incomplete authorization check. When a history record references a deleted conversion, the associated conversion lookup returns None. The previous logic only denied access when the conversion object existed and the visibility check failed. As a result, deleted conversions bypassed the authorization check and their retained history input/output could be disclosed to a user able to request the corresponding history entry. The July 22, 2026 commit changes the logic to deny access whenever the conversion is missing or the requester lacks permission

• CWE-862

• https://github.com/MISP/cti-transmute/commit/88dc65f0117cf7a120f6252674c529e7b9c9b8c3

Published

Aug 10, 2026

Last Modified

Aug 10, 2026

Status

Received

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-72746FreeRDP before 3.30.0 contains a server-side authentication …8.7
• CVE-2026-72747AVideo fails to sanitize the phone field during user registr…7.2
• CVE-2026-72748AVideo contains an unauthenticated arbitrary file write vuln…9.1
• CVE-2026-72749n8n before 1.123.67, 2.31.5, and 2.32.1 contains a prototype…7.1
• CVE-2026-72750n8n before 1.123.67, 2.31.5, and 2.32.1 contains a SQL injec…5.3
• CVE-2026-72751CTI-Transmute is affected by a stored cross-site scripting (…5.1
• CVE-2026-72760Affected versions of MISP cti-transmute disclose users' emai…5.3
• CVE-2026-72761The webhook URL validator in `website/notifications/webhooks…6.9
• CVE-2026-72762n8n versions before 1.123.67, 2.31.5, and 2.32.1 contain an …7.7
• CVE-2026-72763n8n before 1.123.67, 2.31.5, and 2.32.1 validates credential…7.2
• CVE-2026-72764n8n's JavaScript task runner shared a single module cache ac…5.8
• CVE-2026-72765n8n before 2.31.5 and before 2.32.1 contain a sandbox escape…8.7