CVE-2026-38978

MediumCVSS 5.3

Published: 02/06/2026(UTC)Updated: 22/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.31%

23th percentile - higher than 23% of all known CVEs

Summary

Transmission through 4.1.1 has a clickjacking weakness in the WebUI and RPC response paths. An attacker can trick a user into clicking hidden elements, potentially leading to unauthorized actions.

Risk Assessment

An attacker can use clickjacking to hijack the user session, e.g., to change settings or trigger unwanted operations.

Recommendation

Update Transmission to a version later than 4.1.1 that includes clickjacking fixes.

Other vulnerabilities in Transmission

CVE-2026-116748High
Transmission 4.0.0 before 4.1.3 contains a permissive CORS vulnerability in handle_request() in rpc-server.cc that exposes the X-Transmission-Session-Id anti-CSRF token to any web origin. Malicious web pages can read the token from the 409 handshake response and replay it to issue RPC calls, enabling script-torrent-done execution, download-dir changes, or torrent and data deletion.

Original NVD description (English source)

transmission through 4.1.1 was found to have a clickjacking weakness in the browser-facing WebUI and RPC response paths.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS