CVE-2026-69082

Name of the Vulnerable Software and Affected Versions CTI-Transmute (affected versions not specified)

Description A cross-site request forgery issue exists in the administrative user deletion functionality. The '/account/delete/' endpoint accepted HTTP GET requests for operations that modified application state. An unauthenticated remote attacker could induce an authenticated administrator with an active session to visit a malicious link, causing the browser to automatically include session credentials and delete a selected user account without confirmation. This could lead to the unauthorized deletion of arbitrary user accounts, resulting in denial of access for users or disruption of the instance administration. The exploitation relies on the id variable to specify the target account.

Recommendations Restrict the '/account/delete/' endpoint to HTTP POST requests and implement a CSRF token within the deletion form.