The vulnerability resides in CTI‑Transmute’s administrative account deletion endpoint. The /account/delete/<id> URL accepts HTTP GET requests that modify state, allowing an authenticated administrator’s session to be abused by an unauthenticated attacker. An attacker can construct a crafted link or embed a request that, when accessed by an administrator, results in arbitrary user accounts being deleted without explicit confirmation, thereby altering application state and potentially denying access to legitimate users. This CSRF weakness also carries the risk of removing critical administrative accounts, which could impair overall system management.

The affected product is MISP CTI‑Transmute, also known simply as CTI‑Transmute, a tool used for transmuting CTI content. No specific sub‑versions are listed in the advisory; organizations should verify whether their deployed instance is susceptible as the issue exists in versions prior to the patch that implements POST‑only deletion and CSRF protection.

The CVSS score of 8.8 indicates a high severity, while the EPSS score is not provided and the vulnerability is not in the CISA KEV catalog. Exploitation requires a legitimate administrator to visit a maliciously crafted page, which is typically achieved through social‑engineering or phishing. Consequently, the likelihood of exploitation is moderate but significant, especially in environments lacking strict access controls or monitoring of administrative activity.