p PatchFirst

CVE-2026-116748

CVE-2026-116748 · Transmission 4.0.0 before 4.1.3 Permissive CORS Leaks RPC Anti-CSRF Token

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Transmission 4.0.0 before 4.1.3 contains a permissive CORS vulnerability in handle_request() in rpc-server.cc that exposes the X-Transmission-Session-Id anti-CSRF token to any web origin. Malicious web pages can read the token from the 409 handshake response and replay it to issue RPC calls, enabling script-torrent-done execution, download-dir changes, or torrent and data deletion.

CVSS 8.7 · High · EPSS 1.2% · Public exploit · Fix available

Published
Updated

Stack: system

Affected products and versions

  • transmission

    Versions
    • ≥ 4.0.0, < 4.1.3: Affected (semver)

    Update to 4.1.3

  • transmission Debian:12

    Versions
    • 3.00-2.1
    • 3.00-2.1+deb12u1
    • 4.0.1-1
    • 4.0.2-1
    • 4.0.5-1
    • 4.0.5-2
    • 4.0.5-3
    • 4.0.6+dfsg-1
    • 4.0.6+dfsg-2
    • 4.0.6+dfsg-3
    • 4.1.0+dfsg-1
    • 4.1.0+dfsg-1~bpo13+1
    • 4.1.0~beta1+dfsg-1
    • 4.1.0~beta2+dfsg-1
    • 4.1.0~beta2+dfsg-2
    • 4.1.0~beta2+dfsg-3
    • 4.1.0~beta2+dfsg-4
    • 4.1.0~beta2+dfsg-5
    • 4.1.0~beta3+dfsg-1
    • 4.1.0~beta4+dfsg-1
    • 4.1.0~beta5+dfsg-1
    • 4.1.1+dfsg-1
    • 4.1.1+dfsg-1~bpo13+1
    • 4.1.2+dfsg-1
    • 4.1.2+dfsg-1~bpo13+1
    • 4.1.3+dfsg-1
    • 4.1.3+dfsg-1~bpo13+1
    • 4.1.4+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • transmission Debian:13

    Versions
    • 4.1.0+dfsg-1
    • 4.1.0+dfsg-1~bpo13+1
    • 4.1.0~beta2+dfsg-3
    • 4.1.0~beta2+dfsg-3+deb13u1
    • 4.1.0~beta2+dfsg-3+deb13u2
    • 4.1.0~beta2+dfsg-4
    • 4.1.0~beta2+dfsg-5
    • 4.1.0~beta3+dfsg-1
    • 4.1.0~beta4+dfsg-1
    • 4.1.0~beta5+dfsg-1
    • 4.1.1+dfsg-1
    • 4.1.1+dfsg-1~bpo13+1
    • 4.1.2+dfsg-1
    • 4.1.2+dfsg-1~bpo13+1
    • 4.1.3+dfsg-1
    • 4.1.3+dfsg-1~bpo13+1
    • 4.1.4+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • transmission Debian:14

    Versions
    • 4.1.0+dfsg-1
    • 4.1.0+dfsg-1~bpo13+1
    • 4.1.0~beta2+dfsg-3
    • 4.1.0~beta2+dfsg-4
    • 4.1.0~beta2+dfsg-5
    • 4.1.0~beta3+dfsg-1
    • 4.1.0~beta4+dfsg-1
    • 4.1.0~beta5+dfsg-1
    • 4.1.1+dfsg-1
    • 4.1.1+dfsg-1~bpo13+1
    • 4.1.2+dfsg-1
    • 4.1.2+dfsg-1~bpo13+1
    • 4.1.3+dfsg-1~bpo13+1
    Affected ranges
    • ECOSYSTEM: < 4.1.3+dfsg-1

    Update to 4.1.3+dfsg-1

  • transmission Ubuntu:16.04:LTS

    Versions
    • 2.84-1ubuntu1
    • 2.84-2
    • 2.84-3
    • 2.84-3ubuntu1
    • 2.84-3ubuntu2
    • 2.84-3ubuntu3
    • 2.84-3ubuntu3.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • transmission Ubuntu:18.04:LTS

    Versions
    • 2.92-2ubuntu3
    • 2.92-3ubuntu1
    • 2.92-3ubuntu2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • transmission Ubuntu:20.04:LTS

    Versions
    • 2.94-2ubuntu1
    • 2.94-2ubuntu2
    • 2.94-2ubuntu3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • transmission Ubuntu:22.04:LTS

    Versions
    • 3.00-1ubuntu2
    • 3.00-1ubuntu5
    • 3.00-2ubuntu1
    • 3.00-2ubuntu2
    • 3.00-2ubuntu2.1
    • 3.00-2ubuntu2.2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • transmission Ubuntu:24.04:LTS

    Versions
    • 4.0.2-1ubuntu3
    • 4.0.5-1
    • 4.0.5-1build3
    • 4.0.5-1build4
    • 4.0.5-1build5
    • 4.0.5-1ubuntu0.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • transmission Ubuntu:26.10

    Versions
    • 4.1.1+dfsg-1ubuntu1
    • 4.1.2+dfsg-1ubuntu1
    • 4.1.3+dfsg-1ubuntu1
    • 4.1.3+dfsg-1ubuntu2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • transmission Ubuntu:26.04:LTS

    Versions
    • 4.1.0~beta2+dfsg-3ubuntu1
    • 4.1.0~beta2+dfsg-3ubuntu2
    • 4.1.0~beta4+dfsg-1ubuntu1
    • 4.1.0~beta5+dfsg-1ubuntu1
    • 4.1.0+dfsg-1ubuntu1
    • 4.1.1+dfsg-1ubuntu1
    • 4.1.1+dfsg-1ubuntu1.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →