Vulnerability · Published Sep 15, 2026 · Assigned by CIRCL
CVE-2026-91857MISP: State-changing actions accessible via GET request enabling CSRF
Medium 5.3
In plain English
A medium-severity cross-site request forgery in MISP from MISP. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities).
Official description
Affected versions of MISP expose several state-changing controller actions without restricting them to POST. The affected actions are: - EventReportsController::purgeUnusedPictures() - NoticelistsController::enableNoticelist() - ServersController::removeOrphanedCorrelations() - WorkflowsController::rebuildRedis() The patch adds allowMethod(['post']) to each action, preventing them from being triggered through ordinary GET requests. For purgeUnusedPictures(), the corresponding UI previously used $.get(). The fix converts that request to POST and supplies X-CSRF-Token, while the controller enables header-only CSRF validation for that AJAX action. Because GET requests can be induced cross-origin through links, images, redirects, or navigation, accepting GET for these state-changing operations can let an attacker trigger them using the authenticated victim's session. Version affected: ≤2.5.45
Affected products (as reported)
Weakness: CWE-352 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
References
- Security patch patch