CSRF Vulnerability in MISP by Scottish Government National Cyber Team
CVE-2026-90893

5.1MEDIUM

Key Information:

Vendor

Misp

Status
Misp
Vendor
CVE Published:
14 September 2026

What is CVE-2026-90893?

MISP has a Cross-Site Request Forgery (CSRF) vulnerability within the UserSettingsController, allowing attackers to manipulate user settings without consent. Specific actions such as changing the theme, setting the homepage, or toggling event index columns have been improperly secured. This loophole permits an attacker to forge requests by enticing a legitimate user to visit a malicious page, potentially resulting in unauthorized changes including redirection to phishing sites. It is crucial for users to remain vigilant and update their MISP installations to mitigate these risks.

Affected Version(s)

MISP 0 < 2.5.46

References

https://github.com/MISP/MISP/commit/979337b18
patch

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Scottish Government - National Cyber Team
iglocska
Claude Opus 5 (1M context)
.