Transmission’s rpc server implements a permissive CORS policy that permits any web origin to read the X-Transmission-Session-Id anti‑CSRF token from the 409 handshake response. This CWE-942 weakness allows an attacker to host a malicious webpage that first obtains the token, then uses it to issue RPC commands such as script‑torrent‑done, download‑dir changes, or torrent and data deletion. The flaw allows an attacker to control the Transmission daemon via cross‑origin requests; no local privileges are required beyond the user running the web browser.

The vulnerability affects Transmission starting at version 4.0.0 and is present through all versions before 4.1.3. The product is the Transmission BitTorrent client; affected builds are those that expose the RPC interface without restricting the CORS origins.

The CVSS score of 8.7 labels this as a high‑severity flaw. While no EPSS score is available, the absence from the CISA KEV catalog does not diminish the risk of exploitation. The likely attack vector is a victim who has Transmission’s RPC server running and enabled, and who visits a malicious webpage that can issue the cross‑origin request to the local or network‑visible RPC endpoint. The attacker can then replay the captured anti‑CSRF token to execute arbitrary RPC calls and modify or delete user data.