Transmission: Permissive CORS vulnerability (CVE-2026-116748)

Transmission versions 4.0.0 through 4.1.2 contain a permissive Cross-Origin Resource Sharing (CORS) vulnerability within the handle_request() function in rpc-server.cc. This vulnerability allows any web origin to read the X-Transmission-Session-Id anti-CSRF token during a 409 handshake response. By obtaining this token, an unauthorized actor can perform authenticated RPC requests, resulting in unauthorized configuration changes or data deletion.

Impact

Successful exploitation allows an unauthorized remote actor to perform several administrative actions, including:

• Modifying the download directory.
• Deleting torrents and local data.
• Executing scripts via the script-torrent-done feature, which may lead to arbitrary command execution on the host running the Transmission RPC server.

Recommendation

• Upgrade Transmission to version 4.1.3 or later immediately to resolve the insecure CORS handling.
• Restrict access to the Transmission RPC interface to trusted networks only using firewall rules or a reverse proxy.
• Review script-torrent-done configurations to ensure that no malicious scripts are configured to trigger upon torrent completion.