Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-91857— MISP: State-changing actions accessible via GET request enabling CSRF

Quick assessment

Affected
MISP MISP
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

受影响版本的 MISP 暴露了多个会改变系统状态的控制层（controller）操作，但未将其限制为仅接受 POST 请求。 受影响的特定操作如下： 该补丁为每个受影响的操作添加了 约束，从而阻止它们通过普通的 GET 请求被触发。 具体到 方法，原有的用户界面此前使用的是 发起请求。修复方案将该请求改为 POST 方式，并附带发送 ；同时，控制器针对此 AJAX 操作启用了“仅通过请求头进行 CSRF 校验”的机制。 由于 GET 请求可以跨源通过链接、图片、重定向或导航等方式被诱导触发，若允许 GET 请求执行

CVSS 5.3 · Medium

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-91857

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
MISP: State-changing actions accessible via GET request enabling CSRF
Source: CVE Program / CVE List V5
Vulnerability Description
Affected versions of MISP expose several state-changing controller actions without restricting them to POST. The affected actions are:  - EventReportsController::purgeUnusedPictures()  - NoticelistsController::enableNoticelist()  - ServersController::removeOrphanedCorrelations()  - WorkflowsController::rebuildRedis() The patch adds allowMethod(['post']) to each action, preventing them from being triggered through ordinary GET requests. For purgeUnusedPictures(), the corresponding UI previously used $.get(). The fix converts that request to POST and supplies X-CSRF-Token, while the controller enables header-only CSRF validation for that AJAX action. Because GET requests can be induced cross-origin through links, images, redirects, or navigation, accepting GET for these state-changing operations can let an attacker trigger them using the authenticated victim's session. Version affected: ≤2.5.45
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
跨站请求伪造(CSRF)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
MISP MISP 0 ~ 2.5.46 -

II. Public POCs for CVE-2026-91857

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-91857

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-91857 (1)

Same Patch Batch · MISP · 2026-09-15 · 6 CVEs total

CVE-2026-91825 7.1 HIGH MISP: Missing Authorization Check for Event Sharing Group When Distribution Field Is Omitt
CVE-2026-91846 7.1 HIGH MISP Collection Element Add Missing Authorization on Referenced Object UUID
CVE-2026-91819 6.9 MEDIUM MISP: HTTP Method Override Bypasses CSRF and Form Validation in BetterSecurityComponent
CVE-2026-91851 5.3 MEDIUM MISP Dashboard Template ACL Bypass Due to VARCHAR-to-Integer Type Coercion in Permission F
CVE-2026-91859 5.3 MEDIUM MISP Access Log Entry Overwritten by Error Controller's Second beforeFilter Pass

IV. Related Vulnerabilities

Same product: MISP
Same vendor: MISP
Same weakness: CWE-352

V. Comments for CVE-2026-91857

No comments yet

Leave a comment