Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-91819— MISP: HTTP Method Override Bypasses CSRF and Form Validation in BetterSecurityComponent

Quick assessment

Affected
MISP MISP
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

受影响版本的 MISP 依赖 CakePHP 的请求方法重写（request-method override）机制，这种方式可能导致 CSRF 防护和表单安全校验被禁用。 CakePHP 通过识别 字段或 请求头来重写实际生效的请求方法。对于超出常规写操作动词（POST、PUT、PATCH 和 DELETE）的 override 值，CakePHP 还会清空解析后的请求体。随后，MISP 的安全组件会根据请求数据是否仍然存在，来决定是否执行 和 。当使用如下值时： 在这些校验运行之前，请求体已被置空，因此两项防护机

CVSS 6.9 · Medium
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-91819

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
MISP: HTTP Method Override Bypasses CSRF and Form Validation in BetterSecurityComponent
Source: CVE Program / CVE List V5
Vulnerability Description
Affected versions of MISP rely on CakePHP request-method override processing in a way that can disable CSRF and form-security validation. CakePHP honors a _method field or X-HTTP-Method-Override header by rewriting the effective request method. For override values outside the normal write verbs POST, PUT, PATCH, and DELETE, CakePHP also clears the parsed request body. MISP’s security component then determines whether to perform _validatePost() and _validateCsrf() based on whether request data remains. With a value such as: _method=GET the body becomes empty before those checks run, so both protections are skipped. A cross-site form containing only that override can therefore reach actions whose parameters are taken from the URL rather than the request body Version affected: ≤2.5.45
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
跨站请求伪造(CSRF)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
MISP MISP 0 ~ 2.5.46 -

II. Public POCs for CVE-2026-91819

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-91819

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-91819 (1)

Same Patch Batch · MISP · 2026-09-15 · 6 CVEs total

CVE-2026-91825 7.1 HIGH MISP: Missing Authorization Check for Event Sharing Group When Distribution Field Is Omitt
CVE-2026-91846 7.1 HIGH MISP Collection Element Add Missing Authorization on Referenced Object UUID
CVE-2026-91851 5.3 MEDIUM MISP Dashboard Template ACL Bypass Due to VARCHAR-to-Integer Type Coercion in Permission F
CVE-2026-91857 5.3 MEDIUM MISP: State-changing actions accessible via GET request enabling CSRF
CVE-2026-91859 5.3 MEDIUM MISP Access Log Entry Overwritten by Error Controller's Second beforeFilter Pass

IV. Related Vulnerabilities

Same product: MISP
Same vendor: MISP
Same weakness: CWE-352

V. Comments for CVE-2026-91819

No comments yet

Leave a comment