CVE-2026-38978

transmission through 4.1.1 was found to have a clickjacking weakness in the browser-facing WebUI...

5.3 MediumFix available

transmission through 4.1.1 was found to have a clickjacking weakness in the browser-facing WebUI and RPC response paths.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: Low
Availability: None

Exploit likelihood

0.30%Up 0.3 points since Jun 3, 2026

What each source reports

CVE List Score used 5.3

transmission through 4.1.1 was found to have a clickjacking weakness in the browser-facing WebUI and RPC response paths.

Record: CVE-2026-38978
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness: CWE-113
Updated: 2026-11-02

EUVDEUVD-2026-33971 5.3

transmission through 4.1.1 was found to have a clickjacking weakness in the browser-facing WebUI and RPC response paths.

Record: EUVD-2026-33971
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-6rg3-8m29-j28q 5.3

transmission through 4.1.1 was found to have a clickjacking weakness in the browser-facing WebUI...

transmission through 4.1.1 was found to have a clickjacking weakness in the browser-facing WebUI and RPC response paths.

Record: GHSA-6rg3-8m29-j28q
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness: CWE-113
Updated: 2026-11-02

NVD 5.3

transmission through 4.1.1 was found to have a clickjacking weakness in the browser-facing WebUI and RPC response paths.

Record: CVE-2026-38978
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness: CWE-113
Updated: 2026-11-02

OSV 5.3

transmission through 4.1.1 was found to have a clickjacking weakness in the browser-facing WebUI and RPC response paths.

Record: CVE-2026-38978
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated: 2026-11-06

OSVDEBIAN-CVE-2026-38978 5.3

transmission through 4.1.1 was found to have a clickjacking weakness in the browser-facing WebUI and RPC response paths.

Record: DEBIAN-CVE-2026-38978
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated: 2026-11-02

Show 4 moreShow less

OSVUBUNTU-CVE-2026-38978 5.3

transmission through 4.1.1 was found to have a clickjacking weakness in the browser-facing WebUI and RPC response paths.

Record: UBUNTU-CVE-2026-38978
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated: 2026-11-02

OSVMGASA-2026-0293 No score

Updated transmission packages fix a security vulnerability

The updated packages fix a security vulnerability: Transmission through 4.1.1 was found to have a clickjacking weakness in the browser-facing WebUI and RPC response paths. (CVE-2026-38978)

Record: MGASA-2026-0293
Updated: 2026-11-02

OSVopenSUSE-SU-2026:21189-1 No score

Security update for transmission

This update for transmission fixes the following issues:

Changes in transmission:

CVE-2026-38978: add clickjack safeguards when serving http responses (bsc#1267404).

Record: openSUSE-SU-2026:21189-1
Updated: 2026-11-02

OSVUSN-8404-1 No score

transmission vulnerability

It was discovered that Transmission had a clickjacking weakness in the browser-facing WebUI and RPC response paths. An attacker could possibly use this issue to trick users into performing unintended actions.

Record: USN-8404-1
Updated: 2026-11-02

Affected packages

Affected packages
Package	Affected	Fixed
`transmission` Debian:12	All versions, plus listed versions 3.00-2.13.00-2.1+deb12u14.0.1-14.0.2-14.0.5-1 Show 22 moreShow less 4.0.5-24.0.5-34.0.6+dfsg-14.0.6+dfsg-24.0.6+dfsg-34.1.0+dfsg-14.1.0+dfsg-1~bpo13+14.1.0~beta1+dfsg-14.1.0~beta2+dfsg-14.1.0~beta2+dfsg-24.1.0~beta2+dfsg-34.1.0~beta2+dfsg-44.1.0~beta2+dfsg-54.1.0~beta3+dfsg-14.1.0~beta4+dfsg-14.1.0~beta5+dfsg-14.1.1+dfsg-14.1.1+dfsg-1~bpo13+14.1.2+dfsg-14.1.2+dfsg-1~bpo13+14.1.3+dfsg-14.1.3+dfsg-1~bpo13+1	None known
`transmission` Debian:13	before 4.1.0~beta2+dfsg-3+deb13u2, plus listed versions 4.1.0~beta2+dfsg-34.1.0~beta2+dfsg-3+deb13u1	4.1.0~beta2+dfsg-3+deb13u2
`transmission` Debian:14	before 4.1.2+dfsg-1, plus listed versions 4.1.0+dfsg-14.1.0+dfsg-1~bpo13+14.1.0~beta2+dfsg-34.1.0~beta2+dfsg-44.1.0~beta2+dfsg-5 Show 6 moreShow less 4.1.0~beta3+dfsg-14.1.0~beta4+dfsg-14.1.0~beta5+dfsg-14.1.1+dfsg-14.1.1+dfsg-1~bpo13+14.1.2+dfsg-1~bpo13+1	4.1.2+dfsg-1
`transmission` Mageia:10	before 4.1.3-1.mga10	4.1.3-1.mga10
`transmission` Ubuntu:16.04:LTS	All versions, plus listed versions 2.84-1ubuntu12.84-22.84-32.84-3ubuntu12.84-3ubuntu22.84-3ubuntu32.84-3ubuntu3.1	None known
`transmission` Ubuntu:18.04:LTS	All versions, plus listed versions 2.92-2ubuntu32.92-3ubuntu12.92-3ubuntu2	None known
`transmission` Ubuntu:20.04:LTS	All versions, plus listed versions 2.94-2ubuntu12.94-2ubuntu22.94-2ubuntu3	None known
`transmission` Ubuntu:22.04:LTS	before 3.00-2ubuntu2.2, plus listed versions 3.00-1ubuntu23.00-1ubuntu53.00-2ubuntu13.00-2ubuntu23.00-2ubuntu2.1	3.00-2ubuntu2.2
`transmission` Ubuntu:24.04:LTS	before 4.0.5-1ubuntu0.1, plus listed versions 4.0.2-1ubuntu34.0.5-14.0.5-1build34.0.5-1build44.0.5-1build5	4.0.5-1ubuntu0.1
`transmission` Ubuntu:25.10	before 4.1.0~beta2+dfsg-3ubuntu1.1, plus listed versions 4.0.6+dfsg-3ubuntu24.1.0~beta2+dfsg-3ubuntu1	4.1.0~beta2+dfsg-3ubuntu1.1
`transmission` Ubuntu:26.04:LTS	before 4.1.1+dfsg-1ubuntu1.1, plus listed versions 4.1.0~beta2+dfsg-3ubuntu14.1.0~beta2+dfsg-3ubuntu24.1.0~beta4+dfsg-1ubuntu14.1.0~beta5+dfsg-1ubuntu14.1.0+dfsg-1ubuntu14.1.1+dfsg-1ubuntu1	4.1.1+dfsg-1ubuntu1.1
`transmission` openSUSE:Leap 16.0	before 4.0.6-bp160.2.1	4.0.6-bp160.2.1

History

History
Recorded	Changed	Sources
Nov 5, 2026	facts	OSV
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-38978 is a medium vulnerability (CVSS 5.3) in transmission, published June 2, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.30%, the 23rd percentile. Fixed in transmission 4.1.0~beta2+dfsg-3+deb13u2.

References

Show 9 moreShow less