{"id":"CVE-2026-38978","details":"transmission through 4.1.1 was found to have a clickjacking weakness in the browser-facing WebUI and RPC response paths.","modified":"2026-08-12T16:23:57.000471Z","published":"2026-06-02T00:00:00Z","related":["openSUSE-SU-2026:21189-1"],"database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/38xxx/CVE-2026-38978.json","cna_assigner":"mitre"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/38xxx/CVE-2026-38978.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-38978"},{"type":"REPORT","url":"https://github.com/transmission/transmission/issues/8726"},{"type":"FIX","url":"https://github.com/transmission/transmission/commit/6b24c1c214ec6a44fa5fdff0ce7da6b16d8ecaa8"},{"type":"FIX","url":"https://github.com/transmission/transmission/pull/8747"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/transmission/transmission","events":[{"introduced":"0"},{"fixed":"3b502aca113cdb220c6712ea3ff6d51dcbf8f861"},{"fixed":"6b24c1c214ec6a44fa5fdff0ce7da6b16d8ecaa8"}],"database_specific":{"source":["DESCRIPTION","REFERENCES"],"extracted_events":[{"introduced":"0"},{"fixed":"4.1.1"}]}}],"versions":["4.1.0","4.1.0-beta.5","4.1.0-beta.4","4.1.0-beta.3","4.1.0-beta.2","4.1.0-beta.1","4.0.3","4.0.2","4.0.1","4.0.0","4.0.0-beta.3","4.0.0-beta.2","4.0.0-beta.1","3.00","2.92","2.91","2.90","2.83","2.82","2.81","2.80","2.74","2.73","2.72","2.71","2.70","2.61","2.60","2.52","2.51","2.50","2.50b1","2.40","2.40b3","2.40b2","2.40b1","2.33","2.32","2.31","2.30","2.30b4","2.30b3","2.30b2","2.30b1","2.21","2.20","2.20b4","2.20b3","2.20b2","2.20b1","2.13","2.12","2.11","2.10","2.00","1.91","1.90","1.83","1.82","1.81","1.80","1.80b5","1.74","1.73","1.72","1.71","1.70","1.61","1.60","1.40","1.32","1.31","1.22","1.21","1.20","1.11","1.10","1.06","0.80","0.7","0.6","0.5"],"database_specific":{"vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://github.com/transmission/transmission/commit/3b502aca113cdb220c6712ea3ff6d51dcbf8f861","target":{"file":"libtransmission/torrent.cc"},"deprecated":false,"digest":{"line_hashes":["166882553387948988106096467382596750315","175113025769166825013083259736201448594","336488866217607368536020945033441707883","225266330008085492230438071292286709102"],"threshold":0.9},"id":"CVE-2026-38978-38c42cac"},{"digest":{"function_hash":"96785735937719002800501184382156504375","length":5072},"id":"CVE-2026-38978-64f39328","signature_type":"Function","signature_version":"v1","source":"https://github.com/transmission/transmission/commit/6b24c1c214ec6a44fa5fdff0ce7da6b16d8ecaa8","target":{"file":"libtransmission/rpc-server.cc","function":"handle_request"},"deprecated":false},{"source":"https://github.com/transmission/transmission/commit/3b502aca113cdb220c6712ea3ff6d51dcbf8f861","target":{"file":"libtransmission/torrent.cc","function":"tr_torrentSetLocation"},"deprecated":false,"digest":{"length":223,"function_hash":"70897094812369059612233537626272700122"},"id":"CVE-2026-38978-81875926","signature_type":"Function","signature_version":"v1"},{"source":"https://github.com/transmission/transmission/commit/6b24c1c214ec6a44fa5fdff0ce7da6b16d8ecaa8","target":{"file":"libtransmission/rpc-server.cc"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["215936007206132818963529134242901698302","277172573590221647616319288075413366330","128053763517372611836724677293831790717","312342916857223909397311625351801926456","259600417671214015783812729264606596497","108215843786062397252693581652499586611","163648123487238922000555436500097326633"]},"id":"CVE-2026-38978-df79725e","signature_type":"Line","signature_version":"v1"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/transmission/transmission/commit/3b502aca113cdb220c6712ea3ff6d51dcbf8f861","target":{"file":"libtransmission/transmission.h"},"deprecated":false,"digest":{"line_hashes":["321918193528898346907074831791354210277","198517225307178426413488362152768243683","65871947892873091358581332576218311848","50990009688338743323164226560504140327","269028891716585181787430856935887480451","59087695786334711975627315927711454335","255654246227438110952075573549923356756","277839976757990787490331451791802708353","175539068442126263609840176865312305614","63802277985931760517910498180819183897","264329432659084498814618097793512943587","317062569192368891142367847439860621067","74405595819274142265859025283184249658","247606216357256101290627831877141918225","59311316733034190704604663974576832097","147872710592752772118742535906608714867","157280121872256671348518671650315757216","137937921752662393655694349721357349396","321132124629832360225249547914170412371","132781712905183304282589492423416725916","295912225103497213264112523537746949107","28257236641648981327844681408350451554","283337338148864433488051360389200084753","138716798729103889438986338352968983075","252047538539946911930366532059073621406","286158593263082066274410503118453279631","205317559746970141219135015131279031826","108739002098160919274284961388403902481","65504872356435281931835156417126196162","160456140853246462464436263167770692946","102970696731148296397440012822038387525","64770892867374825286759330127820843975","211181998278154350624666667101275786365","278866632528633667354558123649154401583","96719673472749325044067406542349512355","302873835602535458325495846592085396667","338402916338310316869145806487585029362","86383153380282883693511955227432630866","235337040811488549658320750859177503743","47732868915896285170913054575376764442","105119357962339689466425677823970644665","243866951131943335242463982529508404140","26811562809542747587988692084320455771","4237333604943495198678069368863137248","48099869112887346046928822821242676721","102352096409933099664844079901805211907","266735854575755514071790865794429317780","174611849283067316875328068590203489816","280892899490394279085413874402852146047","11501403959405477739140321395252188073","70499496740662987861208164295838843016","265260971659997809882549741751524555391","68926570456916806545787225464786032212"],"threshold":0.9},"id":"CVE-2026-38978-f8054110"}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-38978.json","vanir_signatures_modified":"2026-08-12T16:23:57Z"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}]}