{"id":"CVE-2026-116748","kind":"vulnerability","aliases":["CVE-2026-116748"],"related":[],"title":"Transmission: permissive CORS lets web pages drive the torrent RPC API","description":"Transmission 4.0.0 before 4.1.3 contains a permissive CORS vulnerability in handle_request() in rpc-server.cc that exposes the X-Transmission-Session-Id anti-CSRF token to any web origin. Malicious web pages can read the token from the 409 handshake response and replay it to issue RPC calls, enabling script-torrent-done execution, download-dir changes, or torrent and data deletion.","summary":"Transmission 4.0.0 before 4.1.3 returns its X-Transmission-Session-Id anti-CSRF token to any web origin via permissive CORS in rpc-server.cc. A malicious web page can read that token and replay it to run RPC calls, such as executing script-torrent-done hooks, changing the download directory, or deleting torrents and data.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["linux","macos","package","self-hosted","torrent-clients","transmission","windows"],"not_affected_if":["rpc-not-reachable-from-browsers","versions-4.1.3-or-later"],"how_to_check":"- Run `transmission-daemon --version` or `transmission-remote --version` and check whether it is below `4.1.3`\n- Check whether the RPC interface is reachable from a browser, for example the port set by `rpc-port` (default `9091`) in settings.json\n- Check whether `rpc-whitelist-enabled` and `rpc-authentication-required` are set in settings.json","fix":"- Upgrade Transmission to `4.1.3` or later\n- Until upgraded, enable `rpc-authentication-required` and restrict access with `rpc-whitelist` or a firewall","status":"open","published_at":"2026-10-26T22:16:59+00:00","first_seen_at":"2026-10-26T22:25:34+00:00","triaged_at":"2026-10-26T22:27:32+00:00","updated_at":"2026-10-26T22:27:32+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-26T22:27:32Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Transmission to `4.1.3` or later\n- Until upgraded, enable `rpc-authentication-required` and restrict access with `rpc-whitelist` or a firewall","reach":"network","title":"Transmission: permissive CORS lets web pages drive the torrent RPC API","impact":"high","summary":"Transmission 4.0.0 before 4.1.3 returns its X-Transmission-Session-Id anti-CSRF token to any web origin via permissive CORS in rpc-server.cc. A malicious web page can read that token and replay it to run RPC calls, such as executing script-torrent-done hooks, changing the download directory, or deleting torrents and data.","category":"package","nicknames":[],"who_cares":["transmission","self-hosted","torrent-clients","linux","macos","windows"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker runs scripts on the host and deletes torrents and downloaded data","analyst_note":"Confirm the default rpc-whitelist and authentication settings in the Transmission 4.1.3 release notes, and whether a web-origin exploit is practical without the user's browser on the same network as the daemon.","how_to_check":"- Run `transmission-daemon --version` or `transmission-remote --version` and check whether it is below `4.1.3`\n- Check whether the RPC interface is reachable from a browser, for example the port set by `rpc-port` (default `9091`) in settings.json\n- Check whether `rpc-whitelist-enabled` and `rpc-authentication-required` are set in settings.json","needs_analyst":true,"not_affected_if":["versions-4.1.3-or-later","rpc-not-reachable-from-browsers"],"who_is_affected":"Teams that run Transmission 4.0.0 through 4.1.2 with the RPC web interface reachable from a browser the attacker can lure a user to, such as a desktop or home-server daemon on a network where users browse the web. Installs on a locked-down host with no browser access to the RPC port and no logged-in users browsing the web on that machine are less exposed. Unknown how the sources scope the default configuration.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000722,"input_tokens":3371,"output_tokens":769,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116748':14A,17A '-2026':13A,16A '4.0.0':30B,86C '4.1.3':32B,88C '409':124C 'anti':41B,108C 'anti-csrf':40B,107C 'api':11A 'call':67B,133C 'chang':76B,143C 'client':26B 'contain':89C 'cor':3A,50B,92C 'csrf':42B,109C 'cve':12A,15A 'data':84B,147C 'delet':81B,148C 'dir':142C 'directori':79B 'done':74B,138C 'download':78B,141C 'download-dir':140C 'drive':7A 'enabl':134C 'execut':70B,139C 'expos':100C 'handl':95C 'handshak':125C 'hook':75B 'host':23B 'id':39B,106C 'issu':131C 'let':4A 'linux':18B 'maco':19B 'malici':54B,115C 'origin':47B,114C 'packag':20B 'page':6A,56B,117C 'permiss':2A,49B,91C 'read':58B,119C 'replay':62B,128C 'request':96C 'respons':126C 'return':33B 'rpc':10A,66B,132C 'rpc-server.cc':52B,98C 'run':65B 'script':72B,136C 'script-torrent-don':71B,135C 'self':22B 'self-host':21B 'session':38B,105C 'token':43B,60B,110C,121C 'torrent':9A,25B,73B,82B,137C,145C 'torrent-cli':24B 'transmiss':1A,27B,29B,37B,85C,104C 'via':48B 'vulner':93C 'web':5A,46B,55B,113C,116C 'window':28B 'x':36B,103C 'x-transmission-session-id':35B,102C","nicknames":[],"mitigations":[],"who_affected":"Teams that run Transmission 4.0.0 through 4.1.2 with the RPC web interface reachable from a browser the attacker can lure a user to, such as a desktop or home-server daemon on a network where users browse the web. Installs on a locked-down host with no browser access to the RPC port and no logged-in users browsing the web on that machine are less exposed. Unknown how the sources scope the default configuration.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T22:16:59+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116748","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116748","severity":null,"published_at":"2026-10-26T22:16:59+00:00","modified_at":"2026-10-26T22:16:59+00:00","first_seen_at":"2026-10-26T22:25:34+00:00","fetched_at":"2026-10-26T22:25:34+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}