CVE-2026-73155

CVE-2026-73155 is an IDOR in cti-transmute's reaction endpoint that exposes a structural gap between syntactic validation and authorization enforcement. The react() function validated comment_id syntax and the emoji allowlist—checks that live naturally inside a focused handler—but the access check was expected to live elsewhere: in a decorator, parent function, or middleware. That assumption is where the vulnerability lives. The fix required threading three new dependencies into react(): comments_repo to fetch the actual comment, the conversion association, and the access control predicate. This wasn't a one-line addition—it was architectural restructuring. The refactoring cost is the revealing part. It means the original author designed around the happy path—authenticated user reacting on a known comment—without considering who else might supply a comment_id or what other contexts might invoke this endpoint. When the access check was finally added, it fundamentally changed the function's coupling and statefulness. For your own codebase, the practical question is this: examine every handler that accepts external identifiers (comment IDs, file IDs, record IDs) and ask whether it verifies ownership. If your mental model says "authorization happens upstream," trace that assumption through your commit history. A commit message reading "basic validation only" is the crystallized form of exactly this vulnerability gene. The same assumption that produced CVE-2026-73155 likely infected other handlers in the same codebase—handlers that weren't audited because no CVE was filed for them. Also consider the read-side exposure. Users who couldn't see a comment might still infer its existence through reaction state changes, reaction counts, or metadata. The fix closes the mutation gap; audit whether it created new read gaps elsewhere. The broader lesson is that modular code organization creates invisible gaps when developers assume focused functions should concern themselves only with immediate domain concerns and trust policy enforcement elsewhere. The gap between syntactic validity and policy enforcement is where this entire class of bug lives.

Reviewed through automated stages and approved by a human before publication.