PT-2026-67340
CVE-2026-69079
·
Published
2026-08-03
·
Updated
2026-08-03
Description by
CVSS 4.0
8.7
HighMetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
CTI-Transmute (affected versions not specified)
Description
An uncontrolled resource-consumption issue exists in the unauthenticated '/activity timeline' endpoint. The endpoint accepts a user-controlled
days query parameter that lacks a reasonable range restriction. A remote, unauthenticated attacker can provide an excessively large value for this parameter, forcing the application to retrieve and process activity data over an arbitrarily large period. This action can exhaust database, CPU, or memory resources, delay concurrent request processing, or cause internal server errors, potentially degrading the availability of the website.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Restrict access to the '/activity timeline' endpoint or avoid using the
days parameter until a fix is applied.Exploitability
Exploit
Impacts
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾