CVE-2026-73155

Name of the Vulnerable Software and Affected Versions cti-transmute (affected versions not specified)

Description Authenticated users can add or remove emoji reactions on comments without authorization checks to verify if they are permitted to view the target comment. The react() handler passes a user-controlled comment id directly to comments repo.toggle reaction() after only validating the syntax of the ID and the permitted emoji. This lack of comment-level visibility enforcement allows a user to modify the reaction state of private or inaccessible comments if the ID is known.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.