CVE-2026-72759 misp CVE debrief

Who should care

Security teams and administrators responsible for MISP cti-transmute installations should review and update access controls to prevent potential information disclosure incidents. They should also implement additional authorization checks for history record access, monitor for potential information disclosure incidents, and verify and enforce proper visibility settings for conversion history. This includes ensuring that only authorized users can access conversion history and that deleted conversions do not bypass authorization checks. Affected operators and platforms should prioritize vulnerability management and security team impact assessments to mitigate potential risks. This may involve coordinating with vendors for patches or workarounds and conducting thorough risk assessments to identify potential exposure. Security teams should also consider compensating controls for exposed systems while remediation is scheduled and verified, and track exceptions and retest remediated assets to ensure that vulnerabilities are properly addressed. Furthermore, they should review relevant monitoring, detection, and logs for exposed assets that need extra review to prevent potential information disclosure incidents. By taking these steps, security teams and administrators can help prevent potential security breaches and ensure the integrity of their MISP cti-transmute installations. Additionally, they should consider the operational impact of this vulnerability on their systems and prioritize remediation efforts accordingly. This may involve assigning owners for follow-up, planning vendor-supported updates or mitigations, and verifying that all necessary controls are in place to prevent exploitation. Overall, a comprehensive approach to vulnerability management and security is essential to mitigating the risks associated with this vulnerability. This includes not only addressing the technical aspects of the vulnerability but also considering the broader operational and security implications. By doing so, security teams and administrators can help ensure the security and integrity of their MISP cti-transmute installations and prevent potential information disclosure incidents

Technical summary

The conversion-history details endpoint in MISP cti-transmute performs an incomplete authorization check. When a history record references a deleted conversion, the associated conversion lookup returns None. This allows deleted conversions to bypass the authorization check, potentially disclosing their retained history input/output to users able to request the corresponding history entry. A commit on July 22, 2026, changes the logic to deny access whenever the conversion is missing or the requester lacks permission.

Defensive priority

Medium-priority defensive review recommended due to potential information disclosure.

Recommended defensive actions

• Review and update access controls for the conversion-history details endpoint
• Implement additional authorization checks for history record access
• Monitor for potential information disclosure incidents
• Verify and enforce proper visibility settings for conversion history
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

Evidence from official CVE and NVD sources indicates an incomplete authorization check in MISP cti-transmute's conversion-history details endpoint. The vulnerability allows users to access history input/output for deleted conversions, potentially disclosing sensitive information. Defenders should verify and enforce proper visibility settings for conversion history, review access controls, and monitor for potential information disclosure incidents. The July 22, 2026 commit changes the logic to deny access whenever the conversion is missing or the requester lacks permission, enhancing security.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.