CVE-2026-91819: MISP CSRF Protection Bypass Vulnerability

CVE-2026-91819 Overview

CVE-2026-91819 affects Malware Information Sharing Platform (MISP) versions ≤2.5.45. The flaw lets attackers bypass Cross-Site Request Forgery (CSRF) and form-security validation by abusing CakePHP request-method override handling. A cross-site form submitting _method=GET empties the parsed request body before MISP's security component evaluates whether to run _validatePost() and _validateCsrf(). Both protections are skipped, allowing the request to reach controller actions that consume parameters from the URL. The issue is categorized under [CWE-20] Improper Input Validation.

Critical Impact
Attackers can invoke authenticated MISP actions cross-site without a valid CSRF token, provided the target action accepts input via URL parameters.

Affected Products

MISP versions ≤2.5.45
Deployments relying on CakePHP SecurityComponent for CSRF and form-security enforcement
Any MISP controller action that reads parameters from the URL rather than the request body

Discovery Timeline

2026-09-15 - CVE-2026-91819 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-91819

Vulnerability Analysis

CakePHP's CakeRequest::_processPost() honors either a _method field in the POST body or an X-HTTP-Method-Override header and rewrites REQUEST_METHOD accordingly. For any override value outside the write verbs POST, PUT, PATCH, and DELETE, CakePHP additionally clears $request->data. MISP's SecurityComponent::startup() then computes $hasData from the now-empty body and short-circuits both _validatePost() and _validateCsrf(). The result is a code path where a request is treated as having no submitted data, so form-security enforcement never executes.

Root Cause

The root cause is trust in a client-controlled method override to determine whether server-side security checks apply. Because MISP conditioned CSRF validation on the presence of request data, and the framework empties that data for unusual override verbs, an attacker can force the checks to be skipped. This is an input-validation failure at the boundary between the framework and the application security component.

Attack Vector

Exploitation requires an authenticated victim to load an attacker-controlled page containing a cross-site form. The form submits _method=GET (or an equivalent header) with no other body fields. MISP processes the request under the victim's session against any action whose parameters are read from the URL, effectively performing state-changing operations without a CSRF token. User interaction is required, and the attacker must know or guess a suitable target action URL.

php

     */
    public $doNotGenerateToken = false;

+    /**
+     * The only method overrides CakeRequest acts on without discarding the
+     * request body. Mirrors the list in CakeRequest::_processPost().
+     */
+    const ALLOWED_METHOD_OVERRIDES = array('POST', 'PUT', 'PATCH', 'DELETE');
+
+    /**
+     * Reject `_method` overrides that name anything but a write verb.
+     *
+     * CakeRequest::_processPost() honours a `_method` field in the POST body by
+     * rewriting REQUEST_METHOD, and for any verb outside POST/PUT/PATCH/DELETE
+     * it *also* empties $request->data. SecurityComponent::startup() then reads
+     * $hasData as false and skips both _validatePost() and _validateCsrf(), so a
+     * cross-site form posting nothing but `_method=GET` reaches any action that
+     * takes its input from the URL with form security switched off entirely.
+     *
+     * MISP never emits a `_method` other than those four verbs, so anything else
+     * is refused here - before parent::startup() computes $hasData from the
+     * emptied body.
+     */
+    private function __rejectUnsafeMethodOverride(Controller $controller)
+    {
+        // Header first, then body - the same precedence _processPost() applies.

Source: GitHub MISP Commit 29af008c4

Detection Methods for CVE-2026-91819

Indicators of Compromise

POST requests to MISP endpoints containing a _method form field whose value is not POST, PUT, PATCH, or DELETE.
Requests carrying an X-HTTP-Method-Override header set to values such as GET, HEAD, or OPTIONS.
Referer headers on state-changing MISP requests that point to external, untrusted origins.

Detection Strategies

Inspect web server and reverse-proxy logs for the _method parameter and X-HTTP-Method-Override header on requests to /users/, /events/, and similar MISP controllers.
Alert on authenticated MISP actions that succeed without an accompanying CSRF token field in the request body.
Correlate cross-origin Referer or Origin headers with successful state changes recorded in MISP audit logs.

Monitoring Recommendations

Enable MISP audit logging and forward events to a centralized log platform for correlation with web traffic.
Baseline expected _method values and generate alerts on deviations from POST, PUT, PATCH, or DELETE.
Monitor for anomalous activity patterns tied to individual user sessions, such as rapid configuration changes originating from unusual referers.

How to Mitigate CVE-2026-91819

Immediate Actions Required

Upgrade MISP to a version above 2.5.45 that includes commit 29af008c4.
If immediate upgrade is not possible, apply the upstream patch that rejects _method overrides outside POST, PUT, PATCH, and DELETE.
Review MISP audit logs for suspicious authenticated actions initiated from external referers.

Patch Information

The fix is delivered in MISP commit 29af008c4, which adds __rejectUnsafeMethodOverride() to BetterSecurityComponent. The method inspects both the X-HTTP-Method-Override header and the _method body field before parent::startup() runs, throwing BadRequestException when the override is not one of POST, PUT, PATCH, or DELETE.

Workarounds

Configure a Web Application Firewall (WAF) rule to block requests containing _method values outside POST, PUT, PATCH, and DELETE.
Strip or reject the X-HTTP-Method-Override header at the reverse proxy for requests destined to MISP.
Enforce SameSite=Strict on MISP session cookies to reduce cross-site form submission risk.

bash

# Example NGINX rule to strip the override header and block unsafe _method values
proxy_set_header X-HTTP-Method-Override "";

if ($request_body ~* "(^|&)_method=(?!POST|PUT|PATCH|DELETE)(\w+)") {
    return 400;
}