CVE-2026-85546 MISP Sharing Group Quick-Edit Actions Allow CSRF via State-Changing GET Requests
Attackers can force authenticated users to modify sharing group memberships via crafted GET requests, potentially granting unauthorized access or disrupting information sharing.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-85546?
CVE-2026-85546 is a high-severity vulnerability in misp, published on 4 Sep 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
MISP contains a cross-site request forgery (CSRF) vulnerability in the sharing group quick-edit functionality. The addOrg, removeOrg, addServer, and removeServer actions share the __initialiseSGQuickEdit() helper, where the HTTP method validation intended to restrict these operations to POST requests was commented out.
As a result, these state-changing actions could be invoked using GET requests. An attacker could craft a URL targeting one of the affected actions and cause an authenticated MISP user with sufficient privileges to request it, for example through a malicious link or embedded web resource.
Successful exploitation could modify the membership of a MISP sharing group without the victim intentionally performing the operation. Depending on the action performed, an attacker could add or remove organisations or servers from a sharing group, potentially granting unintended access to information distributed through that sharing group or disrupting legitimate information sharing.
The patch restores HTTP method enforcement centrally in __initialiseSGQuickEdit() by calling allowMethod(['post']), ensuring that all four affected quick-edit operations require POST requests and are therefore subject to the application's normal protections for state-changing requests.
Weakness: CWE-352
Which versions are affected by CVE-2026-85546?
How do I fix CVE-2026-85546?
No fix has been published for CVE-2026-85546 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-85546 being exploited?
There is no known exploitation of CVE-2026-85546 in the wild and no public exploit code.
Sources
Also known as GHSA-cwc4-rgpg-99q3.