Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-91857

MISP: State-changing actions accessible via GET request enabling CSRF

CVSS 4.0 5.3 MEDIUMCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-91857

Published

Affected versions of MISP expose several state-changing controller actions without restricting them to POST. The affected actions are: - EventReportsController::purgeUnusedPictures() - NoticelistsController::enableNoticelist() - ServersController::removeOrphanedCorrelations() - WorkflowsController::rebuildRedis() The patch adds allowMethod(['post']) to each action, preventing them from being triggered through ordinary GET requests. For purgeUnusedPictures(), the corresponding UI previously used $.get(). The fix converts that request to POST and supplies X-CSRF-Token, while the controller enables header-only CSRF validation for that AJAX action. Because GET requests can be induced cross-origin through links, images, redirects, or navigation, accepting GET for these state-changing operations can let an attacker trigger them using the authenticated victim's session. Version affected: ≤2.5.45

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-91857

Published

MISP

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "modules": [
                        "EventReportsController",
                        "NoticelistsController",
                        "ServersController",
                        "WorkflowsController"
                    ],
                    "product": "MISP",
                    "programFiles": [
                        "app/Controller/EventReportsController.php",
                        "app/Controller/NoticelistsController.php",
                        "app/Controller/ServersController.php",
                        "app/Controller/WorkflowsController.php",
                        "app/View/EventReports/managed_imported_pictures.ctp"
                    ],
                    "repo": "https://github.com/MISP/MISP",
                    "vendor": "MISP",
                    "versions": [
                        {
                            "lessThan": "2.5.46",
                            "status": "affected",
                            "version": "0",
                            "versionType": "semver"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON