CVE-2026-90893: MISP UserSettingsController CSRF Vulnerability

CVE-2026-90893 Overview

CVE-2026-90893 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] in the Malware Information Sharing Platform (MISP). The UserSettingsController explicitly added the setTheme, setHomePage, and eventIndexColumnToggle actions to the Security component's unlockedActions list. This disabled both token and field-hash CSRF checks for those POST endpoints. An attacker who tricks an authenticated MISP user into loading a malicious page can forge requests that alter the victim's per-user settings. The most impactful action is setHomePage, which can redirect the victim's default landing page to an attacker-controlled URL. The issue affects MISP versions ≤2.5.45 and was reported by the Scottish Government National Cyber Team.

Critical Impact
An authenticated MISP user visiting an attacker-controlled page can have their default homepage silently redirected to a phishing URL, enabling follow-on credential theft and social engineering.

Affected Products

MISP (Malware Information Sharing Platform) versions ≤2.5.45
app/Controller/UserSettingsController.php component
app/View/Elements/global_menu.ctp client-side AJAX callers

Discovery Timeline

2026-09-14 - CVE-2026-90893 published to the National Vulnerability Database
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-90893

Vulnerability Analysis

MISP is built on the CakePHP framework, which provides a Security component enforcing CSRF token and form field-hash validation on POST requests. In the vulnerable release, three endpoints were removed from that protection by adding them to unlockedActions. The affected endpoints modify authenticated user state: setTheme changes the visual theme, setHomePage sets the default landing URL, and eventIndexColumnToggle changes event index column visibility. Because CSRF validation was fully disabled, cross-origin POSTs from any page a logged-in user visits could invoke these actions.

Root Cause

The root cause is explicit unlocking of state-changing POST actions from the Security component. The beforeFilter method appended eventIndexColumnToggle, setTheme, and setHomePage to $this->Security->unlockedActions, which disables both token verification and the form field-hash check. No same-origin, Referer, or SameSite cookie compensation was in place. The endpoints trust the ambient session cookie sent by the browser on cross-origin submissions.

Attack Vector

Exploitation requires an authenticated MISP session in the victim's browser. The attacker hosts a page that auto-submits a POST to /user_settings/setHomePage/<encoded_url>. When the victim loads the page, the browser attaches the MISP session cookie and the request succeeds. The attacker-supplied URL becomes the victim's default landing page, redirecting future logins to a phishing site. The setTheme and eventIndexColumnToggle actions permit lower-impact UI tampering through the same technique.

php

     public function beforeFilter()
     {
         parent::beforeFilter();
-        $this->Security->unlockedActions[] = 'eventIndexColumnToggle';
-        $this->Security->unlockedActions[] = 'setTheme';
-        $this->Security->unlockedActions[] = 'setHomePage';
-        $this->_csrfTokenHeaderOnly(['setEventTemplateUserFormMode']);
+        // These four are only ever reached by hand-built same-origin AJAX from
+        // the menu/navbar, so they cannot produce the field hash _validatePost()
+        // wants - but they can and do carry the page's CSRF token in the
+        // X-CSRF-Token header, so keep that check rather than unlocking both.
+        $this->_csrfTokenHeaderOnly([
+            'eventIndexColumnToggle',
+            'setTheme',
+            'setHomePage',
+            'setEventTemplateUserFormMode',
+        ]);
         if ($this->action === 'setSetting') {
             $this->Security->unlockedFields = array('value', 'value_select');
         }

Source: MISP commit 979337b18

Detection Methods for CVE-2026-90893

Indicators of Compromise

POST requests to /user_settings/setHomePage/, /user_settings/setTheme/, or /user_settings/eventIndexColumnToggle/ with a Referer or Origin header outside the MISP deployment domain.
Requests to the above endpoints missing the X-CSRF-Token header expected by the patched code path.
Sudden changes to user homepage values in the MISP database that resolve to unfamiliar external URLs.

Detection Strategies

Inspect MISP application logs and reverse-proxy access logs for cross-origin POSTs targeting the three UserSettingsController actions.
Alert when a user's stored homepage setting is modified to a fully qualified URL pointing outside the organization's known asset list.
Correlate suspicious user_settings writes with the same session's browsing of external, untrusted pages immediately prior.

Monitoring Recommendations

Enable audit logging for all MISP user_settings/* mutations and forward events to a central analytics platform.
Baseline expected Origin and Referer values for MISP write endpoints and alert on deviations.
Review the user_settings table periodically for anomalous homepage values across accounts.

How to Mitigate CVE-2026-90893

Immediate Actions Required

Upgrade MISP to a release containing commit 979337b18 or later that reinstates CSRF validation on UserSettingsController endpoints.
Audit the user_settings table for unexpected homepage, theme, or column-visibility values and reset anomalous entries.
Invalidate active sessions and require re-authentication after applying the patch.

Patch Information

The upstream fix removes the three actions from $this->Security->unlockedActions and instead registers them with _csrfTokenHeaderOnly(). The patched client-side code in app/View/Elements/global_menu.ctp sends the X-CSRF-Token header on the AJAX POST from the menu. Apply the fix from MISP commit 979337b18.

Workarounds

Deploy a reverse-proxy rule that rejects POSTs to /user_settings/setHomePage, /user_settings/setTheme, and /user_settings/eventIndexColumnToggle when the Origin or Referer header does not match the MISP hostname.
Configure MISP session cookies with SameSite=Lax or SameSite=Strict to block cross-site cookie attachment on top-level POSTs.
Restrict MISP access to a trusted network segment or VPN to reduce the pool of attackers able to serve malicious pages to authenticated users.

bash

# Example NGINX rule to block cross-origin POSTs to the affected endpoints
location ~ ^/user_settings/(setHomePage|setTheme|eventIndexColumnToggle) {
    if ($request_method = POST) {
        set $bad_origin 1;
        if ($http_origin ~* "^https://misp\.example\.com$") { set $bad_origin 0; }
        if ($bad_origin = 1) { return 403; }
    }
    proxy_pass http://misp_backend;
}