In versions of MISP cti-transmute, the endpoint that returns conversion‑history records performs an incomplete access control check. When the history record refers to a conversion that has already been deleted, the lookup for that conversion returns None. The previous logic only denied access when the conversion object existed and the visibility check failed. Consequently, the history of deleted conversions was returned to any user who could request the history entry, exposing the conversion’s retained input and output data and thereby leaking sensitive information. The weakness is an access‑control flaw (CWE‑862).

This vulnerability affects the MISP cti-transmute product. No specific product versions were enumerated in the CVE data; the issue applies to all affected versions prior to the July 22 2026 patch.

The CVSS score is 6.9, indicating a moderate severity impact. EPSS data is not available, and the vulnerability is not listed in CISA KEV. The likely attack vector is internal: an authenticated user who can identify a history entry that points to a deleted conversion. The vulnerability allows that user to read sensitive input and output data of the deleted conversion without proper authorization. Because the condition relies solely on the existence of a deleted conversion, the exploit is straightforward once the attacker can target the specific history endpoint and is mitigated by the July 22 2026 commit.