CSRF Vulnerability in MISP CTI-Transmute Affected by Insecure GET Requests

CVE-2026-73162

What is CVE-2026-73162?

The vulnerability in MISP's cti-transmute involves the exposure of sensitive account operations through GET requests, including actions like following accounts and managing notifications. These operations, requiring user authentication, could be exploited by attackers using cross-site request forgery techniques. If executed, third-party sites could trigger unintended actions in a victim’s session without their knowledge. The recent patch addresses this issue by migrating these state-changing functions to POST or DELETE requests and implementing an X-CSRFToken header, ensuring robust protection against CSRF attacks.

References