MISP: State-changing actions accessible via GET request enabling CSRF

published 2026-09-15 55 d ago modified 2026-09-16 54 d ago also EUVD-2026-78348

cvss: 5.3; version 4.0, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.2%; EPSS 0.2% chance of exploitation in 30 days, percentile 11%
public exploits: 0; none known

Affected versions of MISP expose several state-changing controller actions without restricting them to POST.

The affected actions are:

- EventReportsController::purgeUnusedPictures()

- NoticelistsController::enableNoticelist()

- ServersController::removeOrphanedCorrelations()

- WorkflowsController::rebuildRedis()

The patch adds allowMethod(['post']) to each action, preventing them from being triggered through ordinary GET requests.

For purgeUnusedPictures(), the corresponding UI previously used $.get(). The fix converts that request to POST and supplies X-CSRF-Token, while the controller enables header-only CSRF validation for that AJAX action.

Because GET requests can be induced cross-origin through links, images, redirects, or navigation, accepting GET for these state-changing operations can let an attacker trigger them using the authenticated victim's session.

Version affected: ≤2.5.45

Patch / fix

fixed in 1 links 1

MISP MISP 2.5.46

github.com/MISP/MISP@b4a5486 commit

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 55 d ago (2026-09-15)

Exploit prediction

0.21% chance of exploitation in the next 30 days, higher than 11% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	4.0	5.3	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
CNA	4.0	5.3	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

MISP MISP

Classification

Weakness

CWE-352 Cross-Site Request Forgery

References

github.com /MISP/MISP/commit/b4a5486b5
patch

Sources

CVE List CVE-2026-91857
NVD CVE-2026-91857

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary