CVE-2026-69079: Unauthenticated Denial of Service via Unbounded Activity-Timeline Range in CTI-Transmute
CTI-Transmute contains an uncontrolled resource-consumption vulnerability in the unauthenticated /activitytimeline endpoint. The endpoint accepts a user-controlled days query parameter that was not restricted to a reasonable range.
A remote, unauthenticated attacker could submit an excessively large value for this parameter, causing the application to retrieve and process activity data over an arbitrarily large period. This could consume excessive database, CPU, or memory resources, delay the processing of concurrent requests, or trigger an internal server error. Repeated requests could further degrade the availability of the CTI-Transmute website.
The vulnerability is corrected by clamping the requested timeline range to a minimum of one day and a maximum of 1,095 days.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Modify the /activity_timeline handler to clamp the days query parameter so the requested timeline range is constrained to a minimum of one day and a maximum of 1,095 days (instead of allowing an arbitrarily large period).
CTI-Transmute /activity_timeline endpoint days (user-controlled query parameter) = clamp to minimum 1 day and maximum 1,095 days
Event History
Frequently Asked Questions
What is the severity of CVE-2026-69079?
CVE-2026-69079 has a risk severity score of 30.
How do I fix CVE-2026-69079?
To fix CVE-2026-69079, restrict the days query parameter in the /activity_timeline endpoint to a controlled, reasonable range.
Can CVE-2026-69079 be exploited by authenticated users?
CVE-2026-69079 can be exploited by unauthenticated users due to the vulnerability in the endpoint.
What could be the impact of CVE-2026-69079?
The impact of CVE-2026-69079 may lead to a Denial of Service due to excessive resource consumption.
Is CVE-2026-69079 specific to a certain version of software?
CVE-2026-69079 affects the CTI-Transmute software specifically, and users should check their version for vulnerabilities.