Authenticated users can add or remove emoji reactions on comments they are not permitted to view. The application bypasses comment‑level visibility checks, allowing manipulation of reaction state on private or otherwise inaccessible comments. This abuse can leak information about the existence of private comments and disrupt legitimate collaboration by altering reaction counts or deleting reactions without authorization.

MISP cti‑transmute is affected. All versions released before the commit that introduced the fix are vulnerable; no specific version list is provided, so any release lacking the patch should be treated as vulnerable.

The CVSS score of 5.3 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is via the web API: an authenticated user must supply a valid comment_id, which may be discovered by enumeration or from other data. Once the comment_id is known, the user can toggle reactions regardless of visibility, leading to the impact described.