CVE-2026-91857

Summary

Affected versions of MISP expose several state-changing controller actions without restricting them to POST.

The affected actions are:

 - EventReportsController::purgeUnusedPictures()

 - NoticelistsController::enableNoticelist()

 - ServersController::removeOrphanedCorrelations()

 - WorkflowsController::rebuildRedis()

The patch adds allowMethod(['post']) to each action, preventing them from being triggered through ordinary GET requests.

For purgeUnusedPictures(), the corresponding UI previously used $.get(). The fix converts that request to POST and supplies X-CSRF-Token, while the controller enables header-only CSRF validation for that AJAX action.

Because GET requests can be induced cross-origin through links, images, redirects, or navigation, accepting GET for these state-changing operations can let an attacker trigger them using the authenticated victim's session.

Version affected: ≤2.5.45

Affected Software

Weaknesses

• CWE-352: CWE-352 Cross-Site Request Forgery (CSRF)

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: partial

References

• https://github.com/MISP/MISP/commit/b4a5486b5

• ←Previous
• Next→