CVE-2026-91857: MISP state-changing actions missing POST requirement

CVE-2026-91857 · Severity: info · CVSS 4.3 · Published 2026-09-15

MISP, a malware and threat intelligence sharing platform, exposed four administrative actions (purge pictures, enable notelists, remove correlations, rebuild cache) that could be triggered via ordinary web links without requiring form submission. An attacker could trick an authenticated administrator into visiting a crafted page, automatically triggering these state-changing operations in the victim's session, leading to data loss or system disruption without the administrator's knowledge.

Technologies: Misp. Vendors: Misp.

Quick answers

Is CVE-2026-91857 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-91857 being exploited in the wild.
How severe is CVE-2026-91857?
Informational severity, with a CVSS score of 4.3, published 15 September 2026.
Which products and versions are affected?
Misp ≤2.5.45.
Is there a fix for CVE-2026-91857?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-91857 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-91857?
Check whether you run Misp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is a missing HTTP method restriction vulnerability affecting four controller actions in MISP versions ≤2.5.45: purgeUnusedPictures(), enableNoticelist(), removeOrphanedCorrelations(), and rebuildRedis(). These actions modify server state but accepted GET requests in addition to POST, making them vulnerable to cross-site request forgery (CSRF) when the authenticated victim visits an attacker-controlled page. An unauthenticated attacker can induce these requests via links, image tags, redirects, or form navigation that fetch the vulnerable URLs. The patch adds HTTP method validation (allowMethod(['post']) to each action and updates the UI to use POST with CSRF tokens instead of GET requests. No patches are currently available for affected versions.

Affected products

  • MISP MISP ≤2.5.45

Timeline

  • 2026-09-15: disclosed: CVE-2026-91857 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.