CVE-2026-116748
High · 8.8CVSS
8.8
EPSS
1.2%
Published
Oct 26, 2026
CISA due date
—
The record
Transmission 4.0.0 before 4.1.3 contains a permissive CORS vulnerability in handle_request() in rpc-server.cc that exposes the X-Transmission-Session-Id anti-CSRF token to any web origin. Malicious web pages can read the token from the 409 handshake response and replay it to issue RPC calls, enabling script-torrent-done execution, download-dir changes, or torrent and data deletion.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-62863 MoLing is a computer-use and browser-use based MCP server. CWE-942
- CVE-2026-119285 Fiber is an Express inspired web framework written in Go. CWE-942
- CVE-2026-110737 The push endpoint of a Vaadin application that uses server push reflects the request… CWE-942
- CVE-2026-115917 vLLM is an inference and serving engine for large language models. CWE-942
- CVE-2026-107858 Missing Origin Validation in WebSockets (CWE-1385) and Permissive Cross-domain Policy… CWE-942
- CVE-2026-89058 A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins… CWE-942
- CVE-2026-53649 Joro is a web exploitation framework. CWE-942
- CVE-2025-61163 Cohere North AI v1.1.5 was discovered to contain excessively permissive cross-domain… CWE-942