CVE-2026-116748: Transmission 4.0.0 before 4.1.3 Permissive CORS Leaks RPC Anti-CSRF Token
Transmission 4.0.0 before 4.1.3 contains a permissive CORS vulnerability in handlerequest() in rpc-server.cc that exposes the X-Transmission-Session-Id anti-CSRF token to any web origin. Malicious web pages can read the token from the 409 handshake response and replay it to issue RPC calls, enabling script-torrent-done execution, download-dir changes, or torrent and data deletion.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Transmissionto a version that resolves this vulnerability.Fixed in 4.1.3
Event History
Frequently Asked Questions
Which deployments are affected?
Transmission versions 4.0.0 before 4.1.3 are affected. The issue is in the RPC server's request handling.
What must an attacker do to exploit this issue?
An attacker needs a victim to interact with a malicious web page. That page can read the X-Transmission-Session-Id token from the RPC 409 handshake response and replay it in RPC requests.
What actions could an attacker perform through the exposed token?
The attacker could issue RPC calls that execute script-torrent-done, change the download directory, or delete torrents and data.
What version addresses the vulnerability?
Transmission 4.1.3 addresses the issue. Systems running versions from 4.0.0 through versions before 4.1.3 should be updated.