CVE-2026-73162: MISP cti-transmute CSRF Vulnerability

CVE-2026-73162 Overview

CVE-2026-73162 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] in MISP cti-transmute. Affected versions expose several state-changing account operations as HTTP GET requests, including /account/follow, /account/delete_notification, /account/mark_notification_read, and /account/mark_all_read. Although these endpoints require authentication, a third-party site can induce an authenticated victim's browser to issue the GET requests automatically. This allows an attacker to trigger account state changes without the user's consent. The patch converts the actions to POST or DELETE and updates the frontend to include an X-CSRFToken header, providing explicit CSRF protection for the affected operations.

Critical Impact
An attacker-controlled site can silently trigger follow/unfollow actions and manipulate notification state on behalf of an authenticated MISP cti-transmute user.

Affected Products

MISP cti-transmute (versions prior to commit c352c2329e48ccc33a2b96d5353450cfbf7e89ec)
Web account endpoints: /account/follow, /account/delete_notification
Web account endpoints: /account/mark_notification_read, /account/mark_all_read

Discovery Timeline

2026-08-11 - CVE-2026-73162 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-73162

Vulnerability Analysis

The vulnerability exists because state-changing account operations were exposed over HTTP GET in the account_blueprint Flask routes. GET requests are automatically issued by browsers when loading resources such as images, scripts, or iframes from third-party origins. When a victim is authenticated to a vulnerable cti-transmute instance, an attacker-hosted page can force the victim's browser to send these GET requests with valid session cookies attached. The server processes the request as a legitimate authenticated action, mutating account state.

Affected actions include following or unfollowing other users, deleting notifications, marking a single notification as read, and marking all notifications as read. The impact is limited to integrity of low-value account metadata, but the pattern indicates a broader lack of CSRF protection across account routes.

Root Cause

Two design flaws produce the vulnerability. First, state-changing endpoints were bound to the GET method, which violates HTTP semantics that reserve GET for safe, idempotent reads. Second, the endpoints did not require a CSRF token, so authenticated cross-origin invocation was indistinguishable from a legitimate first-party request.

Attack Vector

An attacker hosts a page containing a resource such as <img src="https://victim-misp/account/follow?user_id=ATTACKER">. When an authenticated victim visits the attacker's page, the browser sends the request with session cookies, causing the account state change server-side. No user interaction beyond visiting the malicious page is required.

python

#   Follow / Unfollow     #
###########################

-@account_blueprint.route("/follow", methods=['GET'])
+@account_blueprint.route("/follow", methods=['POST'])
@login_required
def follow_user():
    """Follow or unfollow a user."""

Source: MISP/cti-transmute commit c352c232

The patch restricts the route to POST, forcing legitimate callers to include an X-CSRFToken header that cross-origin attackers cannot forge under standard browser policy.

Detection Methods for CVE-2026-73162

Indicators of Compromise

Unexpected GET /account/follow, /account/delete_notification, /account/mark_notification_read, or /account/mark_all_read requests carrying Referer headers pointing to untrusted origins.
User complaints about unexplained follow relationships or notifications disappearing without action.
Web server access logs showing bursts of authenticated GET requests to account endpoints from third-party sites.

Detection Strategies

Review reverse-proxy or WAF logs for GET requests to the four vulnerable account routes and flag any with cross-origin Referer values.
Correlate authentication session identifiers against unusual notification or follow-state transitions in the application database.
Alert on the presence of the deprecated GET route pattern in deployed instances that have not yet applied the patch.

Monitoring Recommendations

Enable audit logging for all account state changes and route them to a central log store for retention and search.
Monitor for HTTP requests to account endpoints that lack the X-CSRFToken header after patch deployment.
Track deployed commit hashes across MISP cti-transmute instances to confirm the fix has been applied.

How to Mitigate CVE-2026-73162

Immediate Actions Required

Update MISP cti-transmute to a build that includes commit c352c2329e48ccc33a2b96d5353450cfbf7e89ec or later.
Audit account activity logs for suspicious follow, unfollow, and notification actions during the exposure window.
Confirm the frontend sends the X-CSRFToken header on all requests to the four patched endpoints.

Patch Information

The upstream fix is available in the MISP repository. The commit converts the affected routes from GET to POST or DELETE and updates the frontend templates to send the X-CSRFToken header. See the MISP cti-transmute security commit for the full diff.

Workarounds

Deploy a reverse-proxy rule that rejects GET requests to /account/follow, /account/delete_notification, /account/mark_notification_read, and /account/mark_all_read until the patch is applied.
Enforce SameSite=Lax or SameSite=Strict on session cookies to reduce cross-origin request attachment.
Instruct users to log out of the application when browsing untrusted sites if patching is delayed.

bash

# Example nginx rule to block GET on the vulnerable endpoints
location ~ ^/account/(follow|delete_notification|mark_notification_read|mark_all_read)$ {
    if ($request_method = GET) {
        return 405;
    }
    proxy_pass http://cti_transmute_backend;
}