CVE-2026-85546: MISP Sharing Group CSRF Vulnerability

CVE-2026-85546 Overview

CVE-2026-85546 is a Cross-Site Request Forgery (CSRF) vulnerability in the Malware Information Sharing Platform (MISP) sharing group quick-edit functionality. The addOrg, removeOrg, addServer, and removeServer actions all funnel through the __initialiseSGQuickEdit() helper, where the HTTP method restriction was commented out. State-changing operations therefore accept GET requests, exposing authenticated users to CSRF attacks via malicious links or embedded resources. Successful exploitation modifies sharing group membership without user intent, potentially adding or removing organisations and servers from a group. This can grant unintended access to shared threat intelligence or disrupt legitimate information sharing between MISP instances.

Critical Impact
An attacker can silently modify MISP sharing group membership by tricking a privileged authenticated user into loading a crafted URL, exposing shared threat intelligence to unauthorised organisations.

Affected Products

MISP (Malware Information Sharing Platform) versions prior to the patched commit 3060d93cb
SharingGroupsController component in app/Controller/SharingGroupsController.php
Deployments exposing the sharing group quick-edit actions to authenticated users

Discovery Timeline

2026-09-04 - CVE-2026-85546 published to the National Vulnerability Database (NVD)
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-85546

Vulnerability Analysis

The vulnerability resides in the __initialiseSGQuickEdit() helper method of the SharingGroupsController. This helper is invoked by four state-changing actions: addOrg, removeOrg, addServer, and removeServer. The original method contained an HTTP method check intended to restrict these operations to POST requests, but the enforcement logic was commented out. As a result, the affected actions accepted GET requests and bypassed the framework's protections for state-changing operations.

MISP is used by security teams to exchange indicators of compromise and threat intelligence. Sharing groups define which organisations and servers receive distributed events. Unauthorised modification of these memberships can silently expose sensitive intelligence to third parties or cut off legitimate recipients. The flaw is tracked as CWE-352: Cross-Site Request Forgery.

Root Cause

The root cause is missing HTTP method enforcement in a shared controller helper. The original MethodNotAllowedException guard was commented out, leaving the method-restriction contract undocumented and inactive. Because the four callers relied on that helper for validation, all inherited the bypass.

Attack Vector

An attacker crafts a URL targeting one of the affected quick-edit actions with attacker-controlled parameters. The attacker then delivers the URL through phishing, a malicious page, or an embedded web resource such as an <img> tag. When an authenticated MISP user with sufficient privileges loads the resource, the browser issues the GET request with the user's session cookies, and the server executes the sharing group modification.

php

    private function __initialiseSGQuickEdit($id, $request)
    {
-        if (!$this->request->is('post') || !$this->_isRest()) {
-            //throw new MethodNotAllowedException('This action only accepts POST requests coming from the API.');
-        }
+        // Guarded here rather than in each of the four callers - addOrg,
+        // removeOrg, addServer and removeServer all funnel through this helper.
+        $this->request->allowMethod(['post']);
        // allow passing the sg_id via a JSON object
        if (!$id) {
            $validParams = array('sg_id', 'sg_uuid', 'id', 'uuid');

Source: MISP security patch commit 3060d93cb

Detection Methods for CVE-2026-85546

Indicators of Compromise

GET requests to /sharing_groups/addOrg, /sharing_groups/removeOrg, /sharing_groups/addServer, or /sharing_groups/removeServer in MISP web server access logs
Unexpected changes in sharing group membership audit records not tied to a corresponding user-initiated POST action
Referer headers on quick-edit requests pointing to external or untrusted origins

Detection Strategies

Parse MISP application audit logs for SharingGroup modification events and correlate with the originating HTTP method and referer
Alert on any non-POST request to the four affected quick-edit endpoints, as the patched behaviour rejects them
Review sharing group history for organisation or server changes performed within seconds of a user browsing external content

Monitoring Recommendations

Enable and centralise MISP audit logging, forwarding events to a SIEM for correlation with web server logs
Baseline normal sharing group administration activity and alert on out-of-hours or bulk membership changes
Monitor for repeated 405 Method Not Allowed responses on the quick-edit endpoints after patching, which can indicate ongoing exploitation attempts

How to Mitigate CVE-2026-85546

Immediate Actions Required

Upgrade MISP to a version that includes commit 3060d93cb or later
Audit sharing group membership for unexpected organisation or server additions and removals
Rotate authentication tokens for privileged MISP accounts if unauthorised changes are identified

Patch Information

The fix restores HTTP method enforcement centrally in __initialiseSGQuickEdit() by calling $this->request->allowMethod(['post']). This ensures all four quick-edit operations require POST requests and are subject to the application's standard CSRF protections for state-changing requests. Details are available in the MISP GitHub commit 3060d93cb.

Workarounds

Restrict access to the MISP web interface behind a VPN or IP allow-list to limit CSRF exposure
Configure a reverse proxy to reject GET requests to /sharing_groups/addOrg, /sharing_groups/removeOrg, /sharing_groups/addServer, and /sharing_groups/removeServer
Advise privileged MISP users to use a dedicated browser profile and log out after administrative sessions

bash

# Example nginx rule to block non-POST requests to quick-edit endpoints
location ~ ^/sharing_groups/(addOrg|removeOrg|addServer|removeServer) {
    limit_except POST { deny all; }
    proxy_pass http://misp_backend;
}