Executive brief
MISP, a malware and threat intelligence sharing platform, exposed four administrative actions (purge pictures, enable notelists, remove correlations, rebuild cache) that could be triggered via ordinary web links without requiring form submission. An attacker could trick an authenticated administrator into visiting a crafted page, automatically triggering these state-changing operations in the victim's session, leading to data loss or system disruption without the administrator's knowledge.
Technical details
This is a missing HTTP method restriction vulnerability affecting four controller actions in MISP versions ≤2.5.45: purgeUnusedPictures(), enableNoticelist(), removeOrphanedCorrelations(), and rebuildRedis(). These actions modify server state but accepted GET requests in addition to POST, making them vulnerable to cross-site request forgery (CSRF) when the authenticated victim visits an attacker-controlled page. An unauthenticated attacker can induce these requests via links, image tags, redirects, or form navigation that fetch the vulnerable URLs. The patch adds HTTP method validation (allowMethod(['post']) to each action and updates the UI to use POST with CSRF tokens instead of GET requests. No patches are currently available for affected versions.
Affected products
- MISP MISP ≤2.5.45
Timeline
- 2026-09-15: disclosed: CVE-2026-91857 published