CVE-2026-91857 MISP: State-changing actions accessible via GET request enabling CSRF
Attackers can trigger state-changing actions like purging data or rebuilding caches via GET requests, exploiting authenticated user sessions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-91857?
CVE-2026-91857 is a medium-severity vulnerability in MISP, published on 15 Sep 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Affected versions of MISP expose several state-changing controller actions without restricting them to POST.
The affected actions are:
- EventReportsController::purgeUnusedPictures()
- NoticelistsController::enableNoticelist()
- ServersController::removeOrphanedCorrelations()
- WorkflowsController::rebuildRedis()
The patch adds allowMethod(['post']) to each action, preventing them from being triggered through ordinary GET requests.
For purgeUnusedPictures(), the corresponding UI previously used $.get(). The fix converts that request to POST and supplies X-CSRF-Token, while the controller enables header-only CSRF validation for that AJAX action.
Because GET requests can be induced cross-origin through links, images, redirects, or navigation, accepting GET for these state-changing operations can let an attacker trigger them using the authenticated victim's session.
Version affected: ≤2.5.45
Weakness: CWE-352
Which versions are affected by CVE-2026-91857?
How do I fix CVE-2026-91857?
No fix has been published for CVE-2026-91857 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-91857 being exploited?
There is no known exploitation of CVE-2026-91857 in the wild and no public exploit code.
Sources
Also known as GHSA-6wvj-vm6h-rf24.