Executive brief
MISP is an open-source platform for sharing threat intelligence and indicators of compromise among organizations. A CSRF vulnerability in the sharing group management feature allows an attacker to trick an authenticated administrator into unknowingly adding or removing organizations and servers from a sharing group via a malicious link or webpage, potentially granting or revoking unintended access to sensitive threat data.
Technical details
A cross-site request forgery (CSRF) vulnerability exists in the sharing group quick-edit functionality of MISP, specifically in the addOrg, removeOrg, addServer, and removeServer actions within SharingGroupsController. The __initialiseSGQuickEdit() helper method had HTTP method validation (allowMethod(['post'])) commented out, allowing these state-changing operations to be invoked via GET requests instead of the required POST. An attacker can craft a URL targeting one of these actions and cause an authenticated user to request it—for example via a malicious link, image tag, or iframe—resulting in unauthorized modification of sharing group membership without the victim's knowledge. A patch has been released (commit 3060d93) that restores the POST-only enforcement in __initialiseSGQuickEdit().
Affected products
- MISP MISP affected versions prior to patch commit 3060d93
Timeline
- 2026-09-04: disclosed: CVE-2026-85546 published
- 2026-09-04: patched: Security fix applied in commit 3060d93