CVE-2026-73162

Summary

Affected versions of MISP cti-transmute expose several state-changing account operations as GET requests:

/account/follow

/account/delete_notification

/account/mark_notification_read

/account/mark_all_read

These endpoints require authentication, but before the fix they could be invoked with simple GET requests. That makes them susceptible to cross-site request forgery because a third-party site can induce the victim’s browser to send authenticated GET requests automatically.

The patch converts the actions to POST or DELETE and updates the frontend to include an X-CSRFToken header, providing explicit CSRF protection for those state-changing operations.

Affected Software

Weaknesses

• CWE-352: CWE-352 Cross-Site Request Forgery (CSRF)

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: yes
  • Technical Impact: partial

References

• https://github.com/MISP/cti-transmute/commit/c352c2329e48ccc33a2b96d5353450cfbf7e89ec

• ←Previous
• Next→