Cross-Site Request Forgery Vulnerability in MISP by MISP Project

CVE-2026-91819

What is CVE-2026-91819?

Certain versions of MISP are susceptible to a security flaw stemming from the handling of request method overrides by CakePHP. When an attacker exploits this vulnerability using the _method field or X-HTTP-Method-Override header to set the request method to a non-standard value, it can inadvertently disable CSRF and form-security validations. Consequently, any cross-site form containing this override can exploit the bug, allowing unauthorized actions to be executed without proper validation mechanisms in place. This occurs because the parsed request body is cleared, leading to the skipping of essential validation checks. Users are advised to upgrade to a fixed version to mitigate this risk.

References