Executive brief
MISP cti-transmute is a web-based tool for managing threat intelligence data. The application exposed several account operations—such as following users, deleting notifications, and marking messages as read—as simple GET requests. This allowed attackers to trick users into performing these actions unknowingly via malicious websites, potentially compromising account security and user experience.
Technical details
The vulnerability is a cross-site request forgery (CSRF) flaw in multiple account-related endpoints (/account/follow, /account/delete_notification, /account/mark_notification_read, /account/mark_all_read). These endpoints performed state-changing operations but accepted GET requests instead of POST or DELETE, and lacked explicit CSRF tokens. An unauthenticated attacker could craft a third-party website that induces a victim's browser to send authenticated GET requests to these endpoints, causing unintended account modifications. The fix converted these endpoints to require POST or DELETE methods and added X-CSRFToken header validation in the frontend. Patches were released on 2026-07-23.
Affected products
- MISP cti-transmute versions prior to commit c352c23
Timeline
- 2026-08-11: disclosed