CVE-2026-91857: MISP CSRF Vulnerability

CVE-2026-91857 Overview

CVE-2026-91857 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] in Malware Information Sharing Platform (MISP) versions ≤2.5.45. Several state-changing controller actions accept HTTP GET requests without enforcing POST, allowing attackers to trigger sensitive operations using an authenticated victim's session. Because browsers issue GET requests automatically through links, images, redirects, or navigation, an attacker can cause the victim's browser to invoke these endpoints cross-origin. The affected actions include purgeUnusedPictures(), enableNoticelist(), removeOrphanedCorrelations(), and rebuildRedis().

Critical Impact
Authenticated MISP users can be tricked into executing state-changing operations, including deleting event report pictures, enabling notice lists, removing orphaned correlations, and rebuilding Redis workflow state, by simply visiting a malicious page.

Affected Products

MISP (Malware Information Sharing Platform) versions ≤2.5.45
EventReportsController and NoticelistsController components
ServersController and WorkflowsController components

Discovery Timeline

2026-09-15 - CVE-2026-91857 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-91857

Vulnerability Analysis

The vulnerability is a classic Cross-Site Request Forgery flaw [CWE-352]. MISP exposes four state-changing controller actions that respond to HTTP GET requests: EventReportsController::purgeUnusedPictures(), NoticelistsController::enableNoticelist(), ServersController::removeOrphanedCorrelations(), and WorkflowsController::rebuildRedis(). State-changing operations should require POST and CSRF token validation. Because GET requests are trivially triggered cross-origin, an attacker can embed a crafted URL in a page, email, or advertisement viewed by an authenticated MISP administrator. The victim's browser then dispatches the request with valid session cookies, and the server performs the action without verifying intent.

Root Cause

The root cause is missing HTTP method restriction on controller actions that modify server state. MISP's affected actions did not call allowMethod(['post']), so the framework accepted any HTTP verb. For purgeUnusedPictures(), the associated UI additionally used a jQuery $.get() call, meaning the workflow had no rendered form supplying a CSRF field hash. This combination allowed cross-origin request forgery against operations that delete pictures, toggle notice lists, purge correlation data, and rebuild Redis state.

Attack Vector

Exploitation requires an authenticated MISP user to visit an attacker-controlled resource. A single <img src="https://misp.example/noticelists/enableNoticelist/1/1"> tag or a redirect chain is sufficient to trigger any of the affected endpoints. User interaction is limited to loading the page. The attacker cannot read the response due to same-origin policy, but the state change is committed server-side.

php

// Patch: app/Controller/NoticelistsController.php
public function enableNoticelist($id, $enable = false)
{
    $this->request->allowMethod(['post']);
    $this->Noticelist->id = $id;
    if (!$this->Noticelist->exists()) {
        throw new NotFoundException(__('Noticelist not found.'));

Source: MISP commit b4a5486b5

php

// Patch: app/Controller/EventReportsController.php
public function beforeFilter()
{
    parent::beforeFilter();
    // purgeUnusedPictures is only ever reached by the picture management
    // page's hand-built AJAX, which has no rendered form behind it to
    // produce the field hash _validatePost() compares against. It sends
    // the page's CSRF token in the X-CSRF-Token header instead.
    $this->_csrfTokenHeaderOnly(['purgeUnusedPictures']);
}

Source: MISP commit b4a5486b5

The patch adds allowMethod(['post']) to each affected action and enables header-only CSRF validation for the purgeUnusedPictures AJAX endpoint via X-CSRF-Token.

Detection Methods for CVE-2026-91857

Indicators of Compromise

Web server access logs showing GET requests to /eventReports/purgeUnusedPictures, /noticelists/enableNoticelist/*, /servers/removeOrphanedCorrelations, or /workflows/rebuildRedis.
Requests to the endpoints above with a Referer header pointing to an untrusted third-party origin.
Unexpected changes to notice list enablement state or missing event report pictures in MISP audit logs.

Detection Strategies

Alert on any HTTP GET method targeting the four affected controller actions on unpatched MISP instances.
Correlate authenticated MISP session activity with cross-origin Referer values on state-changing paths.
Review MISP audit logs for enableNoticelist, removeOrphanedCorrelations, and rebuildRedis events without a corresponding administrative UI session.

Monitoring Recommendations

Enable verbose access logging on the MISP reverse proxy and forward logs to a centralized analytics platform for review.
Baseline expected administrative activity and flag off-hours or externally-referred state-changing requests.
Monitor for repeated GET requests to the affected endpoints, which may indicate scanning or forced-browsing attempts.

How to Mitigate CVE-2026-91857

Immediate Actions Required

Upgrade MISP to a version newer than 2.5.45 that includes commit b4a5486b5.
Restrict access to the MISP web interface to trusted networks or via VPN until the patch is applied.
Advise MISP administrators to log out of MISP when not actively using it and avoid browsing untrusted sites in the same browser session.

Patch Information

The upstream fix is available in the MISP GitHub repository at commit b4a5486b5. The patch enforces allowMethod(['post']) on purgeUnusedPictures(), enableNoticelist(), removeOrphanedCorrelations(), and rebuildRedis(). It also converts the picture management UI from $.get() to POST with an X-CSRF-Token header, and enables header-only CSRF validation for that AJAX action via _csrfTokenHeaderOnly().

Workarounds

Deploy a reverse proxy or Web Application Firewall (WAF) rule that rejects GET requests to the four affected endpoints and only forwards POST requests.
Enforce a strict SameSite=Strict cookie attribute on the MISP session cookie to reduce cross-origin request delivery.
Segment MISP administrative access to a dedicated browser profile or workstation that does not browse the general internet.

bash

# Example nginx rule to block GET on affected state-changing MISP endpoints
location ~ ^/(eventReports/purgeUnusedPictures|noticelists/enableNoticelist|servers/removeOrphanedCorrelations|workflows/rebuildRedis) {
    limit_except POST {
        deny all;
    }
    proxy_pass http://misp_backend;
}