State-Changing Actions Vulnerability in MISP by MISP

CVE-2026-91857

What is CVE-2026-91857?

A security vulnerability in MISP allows several state-changing controller actions to be triggered via GET requests, leading to potential unauthorized actions using an authenticated user's session. Actions such as purging unused pictures, enabling noticelists, and others were not restricted to POST methods, exposing the system to risks. The patch effectively addresses this issue by enforcing method restrictions, thus ensuring that only POST requests can invoke these critical state-changing functionalities. Additionally, the fix improves CSRF protection by enabling header-only CSRF validation for AJAX actions, reducing the attack surface for cross-origin requests.

References