CVE-2026-69079

Name of the Vulnerable Software and Affected Versions CTI-Transmute (affected versions not specified)

Description An uncontrolled resource-consumption issue exists in the unauthenticated '/activity timeline' endpoint. The endpoint accepts a user-controlled days query parameter that lacks a reasonable range restriction. A remote, unauthenticated attacker can provide an excessively large value for this parameter, forcing the application to retrieve and process activity data over an arbitrarily large period. This action can exhaust database, CPU, or memory resources, delay concurrent request processing, or cause internal server errors, potentially degrading the availability of the website.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Restrict access to the '/activity timeline' endpoint or avoid using the days parameter until a fix is applied.