CVE-2026-116748

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-116748", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-10-26T20:23:37.457Z", "datePublished": "2026-10-26T21:52:45.799Z", "dateUpdated": "2026-10-31T02:02:38.641Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-26T21:52:45.799Z"}, "datePublic": "2026-06-25T00:00:00.000Z", "title": "Transmission 4.0.0 before 4.1.3 Permissive CORS Leaks RPC Anti-CSRF Token", "descriptions": [{"lang": "en", "value": "Transmission 4.0.0 before 4.1.3 contains a permissive CORS vulnerability in handle_request() in rpc-server.cc that exposes the X-Transmission-Session-Id anti-CSRF token to any web origin. Malicious web pages can read the token from the 409 handshake response and replay it to issue RPC calls, enabling script-torrent-done execution, download-dir changes, or torrent and data deletion."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Permissive Cross-domain Security Policy with Untrusted Domains", "cweId": "CWE-942", "type": "CWE"}]}], "affected": [{"vendor": "transmission", "product": "transmission", "defaultStatus": "unaffected", "versions": [{"version": "4.0.0", "status": "affected", "versionType": "semver", "lessThan": "4.1.3"}], "packageURL": "pkg:github/transmission/transmission", "repo": "https://github.com/transmission/transmission"}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:transmissionbt:transmission:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.0.0", "versionEndExcluding": "4.1.3"}]}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH"}}], "references": [{"url": "https://github.com/transmission/transmission/pull/8938", "tags": ["issue-tracking", "patch"], "name": "Pull Request #8938"}, {"url": "https://github.com/transmission/transmission/commit/c6a1bd2017a0fea9c956737c213f23e4b0f7929e", "tags": ["patch"], "name": "Patch Commit"}, {"url": "https://github.com/transmission/transmission", "tags": ["product"]}, {"url": "https://github.com/transmission/transmission/releases/tag/4.1.3", "tags": ["release-notes"], "name": "transmission 4.1.3 Release Notes"}, {"url": "https://github.com/transmission/transmission/blob/4.1.2/libtransmission/rpc-server.cc#L560", "tags": ["technical-description"]}, {"url": "https://joshua.hu/transmission-cors-rpc-csrf-rce-drive-by-exploit", "tags": ["third-party-advisory"]}, {"name": "VulnCheck Advisory: Transmission 4.0.0 before 4.1.3 Permissive CORS Leaks RPC Anti-CSRF Token", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/transmission-4.0.0-before-4.1.3-permissive-cors-leaks-rpc-anti-csrf-token"}], "credits": [{"lang": "en", "value": "Joshua Rogers", "type": "finder"}, {"lang": "en", "value": "ckerr", "type": "remediation developer"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-31T02:02:29.585820Z", "id": "CVE-2026-116748", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-31T02:02:38.641Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-116748", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-31T02:02:29.585820Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-31T02:02:34.607Z"}}], "cna": {"title": "Transmission 4.0.0 before 4.1.3 Permissive CORS Leaks RPC Anti-CSRF Token", "credits": [{"lang": "en", "type": "finder", "value": "Joshua Rogers"}, {"lang": "en", "type": "remediation developer", "value": "ckerr"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 8.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"repo": "https://github.com/transmission/transmission", "vendor": "transmission", "product": "transmission", "versions": [{"status": "affected", "version": "4.0.0", "lessThan": "4.1.3", "versionType": "semver"}], "packageURL": "pkg:github/transmission/transmission", "defaultStatus": "unaffected"}], "datePublic": "2026-06-25T00:00:00.000Z", "references": [{"url": "https://github.com/transmission/transmission/pull/8938", "name": "Pull Request #8938", "tags": ["issue-tracking", "patch"]}, {"url": "https://github.com/transmission/transmission/commit/c6a1bd2017a0fea9c956737c213f23e4b0f7929e", "name": "Patch Commit", "tags": ["patch"]}, {"url": "https://github.com/transmission/transmission", "tags": ["product"]}, {"url": "https://github.com/transmission/transmission/releases/tag/4.1.3", "name": "transmission 4.1.3 Release Notes", "tags": ["release-notes"]}, {"url": "https://github.com/transmission/transmission/blob/4.1.2/libtransmission/rpc-server.cc#L560", "tags": ["technical-description"]}, {"url": "https://joshua.hu/transmission-cors-rpc-csrf-rce-drive-by-exploit", "tags": ["third-party-advisory"]}, {"url": "https://www.vulncheck.com/advisories/transmission-4.0.0-before-4.1.3-permissive-cors-leaks-rpc-anti-csrf-token", "name": "VulnCheck Advisory: Transmission 4.0.0 before 4.1.3 Permissive CORS Leaks RPC Anti-CSRF Token", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "Transmission 4.0.0 before 4.1.3 contains a permissive CORS vulnerability in handle_request() in rpc-server.cc that exposes the X-Transmission-Session-Id anti-CSRF token to any web origin. Malicious web pages can read the token from the 409 handshake response and replay it to issue RPC calls, enabling script-torrent-done execution, download-dir changes, or torrent and data deletion."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-942", "description": "Permissive Cross-domain Security Policy with Untrusted Domains"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:transmissionbt:transmission:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.1.3", "versionStartIncluding": "4.0.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-26T21:52:45.799Z"}}}, "cveMetadata": {"cveId": "CVE-2026-116748", "state": "PUBLISHED", "dateUpdated": "2026-10-31T02:02:38.641Z", "dateReserved": "2026-10-26T20:23:37.457Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-10-26T21:52:45.799Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:github/transmission/transmission", "product": "transmission", "repo": "https://github.com/transmission/transmission", "vendor": "transmission", "versions": [{"lessThan": "4.1.3", "status": "affected", "version": "4.0.0", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Transmission 4.0.0 before 4.1.3 contains a permissive CORS vulnerability in handle_request() in rpc-server.cc that exposes the X-Transmission-Session-Id anti-CSRF token to any web origin. Malicious web pages can read the token from the 409 handshake response and replay it to issue RPC calls, enabling script-torrent-done execution, download-dir changes, or torrent and data deletion."}], "id": "CVE-2026-116748", "lastModified": "2026-10-31T03:17:17.027", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-116748", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-31T02:02:29.585820Z", "version": "2.0.3"}}]}, "published": "2026-10-26T22:16:59.610", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/transmission/transmission"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/transmission/transmission/blob/4.1.2/libtransmission/rpc-server.cc#L560"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/transmission/transmission/commit/c6a1bd2017a0fea9c956737c213f23e4b0f7929e"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/transmission/transmission/pull/8938"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/transmission/transmission/releases/tag/4.1.3"}, {"source": "disclosure@vulncheck.com", "url": "https://joshua.hu/transmission-cors-rpc-csrf-rce-drive-by-exploit"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/transmission-4.0.0-before-4.1.3-permissive-cors-leaks-rpc-anti-csrf-token"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-942"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{"bugzilla": {"description": "transmission: Transmission: Arbitrary code execution via overly permissive CORS policy", "id": "2561452", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2561452"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.8", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-346", "details": ["Transmission 4.0.0 before 4.1.3 contains a permissive CORS vulnerability in handle_request() in rpc-server.cc that exposes the X-Transmission-Session-Id anti-CSRF token to any web origin. Malicious web pages can read the token from the 409 handshake response and replay it to issue RPC calls, enabling script-torrent-done execution, download-dir changes, or torrent and data deletion.", "A flaw was found in Transmission. This vulnerability allows a remote attacker to execute arbitrary code, modify application settings, or delete data by exploiting an overly permissive Cross-Origin Resource Sharing (CORS) policy in the remote procedure call (RPC) server. By tricking a user into visiting a malicious website, an attacker can capture the exposed session token from handshake responses and replay it to issue unauthorized RPC commands to the local Transmission service."], "name": "CVE-2026-116748", "public_date": "2026-10-26T21:52:45Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-116748\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-116748\nhttps://github.com/transmission/transmission\nhttps://github.com/transmission/transmission/blob/4.1.2/libtransmission/rpc-server.cc#L560\nhttps://github.com/transmission/transmission/commit/c6a1bd2017a0fea9c956737c213f23e4b0f7929e\nhttps://github.com/transmission/transmission/pull/8938\nhttps://github.com/transmission/transmission/releases/tag/4.1.3\nhttps://joshua.hu/transmission-cors-rpc-csrf-rce-drive-by-exploit\nhttps://www.vulncheck.com/advisories/transmission-4.0.0-before-4.1.3-permissive-cors-leaks-rpc-anti-csrf-token"], "statement": "This vulnerability is rated as Important because an attacker can achieve code execution or data destruction in the context of the user running Transmission by leveraging cross-origin requests from a malicious webpage. While exploitation requires user interaction to visit a compromised site, the lack of origin validation allows direct compromise of the remote procedure call service without prior system access. Transmission is not included in core Red Hat Enterprise Linux releases, limiting exposure primarily to Extra Packages for Enterprise Linux (EPEL) and Fedora environments.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.0.0,4.1.3)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "transmission", "source": "cna", "vendor": "transmission"}, "product": "transmission", "vendor": "transmissionbt"}], "created": "2026-10-27T07:15:08.219257+00:00", "updated": "2026-10-30T14:15:08.274865+00:00", "vendors": ["transmissionbt", "transmissionbt$PRODUCT$transmission"]}