Executive brief
MISP, an open-source threat intelligence platform used by organizations to manage and share security indicators, is vulnerable to cross-site request forgery (CSRF) attacks. An attacker can trick a logged-in MISP user into visiting a malicious website, which can then make unauthorized changes to threat data, including creating, modifying, or deleting intelligence records using the victim's privileges.
Technical details
The vulnerability exists in MISP's form-security and CSRF protection logic, which incorrectly disables validation for requests detected as REST traffic based on properties like the Accept header or URL suffix, rather than the actual authentication method. An attacker can craft cross-origin requests with Accept: application/json headers that bypass CORS preflight requirements and trick MISP into treating authenticated session requests as REST API calls, thereby exempting them from CSRF validation. This allows an unauthenticated attacker to perform unauthorized state changes on protected endpoints using a victim's authenticated session. The fix restricts CSRF and form-security exemptions to requests carrying valid MISP API keys, and introduces X-CSRF-Token header support for legitimate same-origin AJAX requests, which cannot be set by cross-origin pages without a CORS preflight.
Affected products
- MISP MISP
Timeline
- 2026-09-04: disclosed