CSRF Vulnerability in MISP Affecting Event Deletion Process

CVE-2026-85236

What is CVE-2026-85236?

A vulnerability in the cullEmptyEvents action of MISP allows an attacker to exploit cross-site request forgery (CSRF) due to improper validation of HTTP GET requests. By tricking an authenticated user into accessing a malicious URL, an attacker can trigger irreversible deletions of published empty events without user consent. The operation bypasses standard blocklist checks, meaning the deleted events cannot be recovered or tracked. The vulnerability was resolved by restricting access to the cullEmptyEvents endpoint to HTTP POST requests, enabling standard CSRF protections.

References