MISP contains a Cross-Site Request Forgery (CSRF) vulnerability in the UserSettingsController. The actions setTheme, setHomePage, and eventIndexColumnToggle were explicitly added to the Security component's unlockedActions list, which disabled all CSRF validation (both token and field-hash checks) for those endpoints. Because these endpoints accept POST requests and modify per-user application state (theme selection, default homepage URL, and event index column visibility), an attacker who can induce a logged-in MISP user to load a malicious page (e.g., via a crafted link, embedded image, or auto-submitting form) can forge requests that alter the victim's settings without their knowledge or consent. The most impactful action is setHomePage, which allows an attacker to redirect the victim's default landing page to an arbitrary attacker-controlled URL, potentially facilitating phishing or further social engineering. The setTheme action can alter the user's visual theme, and eventIndexColumnToggle can change which columns are displayed in the event index view. No authentication bypass is involved; the victim must already be authenticated to MISP. The vulnerability was reported by the Scottish Government National Cyber Team.
Version affected: ≤2.5.45
The fix removes the three affected actions from the Security component's unlockedActions list (which had disabled all CSRF checks) and instead registers them under a header-only CSRF token validation mechanism (_csrfTokenHeaderOnly). This requires the X-CSRF-Token header to be present and valid on each request while still permitting the AJAX-style calls that lack traditional form fields. Client-side JavaScript and view templates are updated to include the X-CSRF-Token header (sourced from window.csrfToken) in all AJAX and fetch calls to these endpoints, ensuring legitimate same-origin requests continue to function while cross-origin forged requests are rejected.
"}],"value":"The fix removes the three affected actions from the Security component's unlockedActions list (which had disabled all CSRF checks) and instead registers them under a header-only CSRF token validation mechanism (_csrfTokenHeaderOnly). This requires the X-CSRF-Token header to be present and valid on each request while still permitting the AJAX-style calls that lack traditional form fields. Client-side JavaScript and view templates are updated to include the X-CSRF-Token header (sourced from window.csrfToken) in all AJAX and fetch calls to these endpoints, ensuring legitimate same-origin requests continue to function while cross-origin forged requests are rejected."}],"title":"MISP UserSettingsController CSRF Protection Bypass on setTheme, setHomePage, and eventIndexColumnToggle Endpoints","x_gcve":[{"extensions":{"bcp-05-x-01":{"ai_annotations":[{"ai_level":"generated","description":"Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.","gna_source":1,"models":[{"gna_source":1,"identifier":"qwen3.8:27b","name":"qwen3.8:27b","source":"ollama"}],"review_status":"review","scope":"record","tags":["ai-computer-assisted:llm-generated","ai-computer-assisted:classification"]}]},"bcp-05-x-02":{"x_patch2vuln":{"assumptions":["The MISP instance is assumed to be deployed in a standard configuration where the Security component's CSRF protection is enabled by default; if an operator had globally disabled CSRF checks, this specific vulnerability would be subsumed by that broader misconfiguration.","The setHomePage endpoint is assumed to accept an arbitrary URL path as its argument based on the patch comment stating 'a single path the user picks anyway and which setSetting() validates server-side'; the exact validation logic was not visible in the patch.","Exact affected version range could not be determined from the patch alone; the fix commit is 225 commits after the v2.5.46 tag, suggesting the vulnerability existed in releases around and after v2.5.46, but precise boundaries are unspecified.","CVSS UI:P assumes the victim must load an attacker-controlled page; if MISP is deployed behind a strict CSP that blocks cross-origin form submission, exploitability may be reduced, but this is not confirmed by the patch."],"commit":"979337b182ae666fe1387342e20e061613657e83","confidence":"medium","credits":[{"lang":"en","type":"reporter","value":"Scottish Government - National Cyber Team"},{"lang":"en","type":"remediation developer","value":"iglocska"},{"lang":"en","type":"remediation developer","value":"Claude Opus 5 (1M context)"},{"lang":"en","type":"tool","value":"Claude Opus 5 (1M context)"}],"cvssRationale":"AV:N: The attack is delivered over the network via a malicious web page. AC:L: CSRF exploitation is straightforward with no race conditions or special timing. AT:N: No special target state is required beyond normal authentication. PR:N: The attacker requires no privileges on the MISP instance. UI:P: The victim must passively load the attacker's page while authenticated (e.g., click a link or visit a site). VC:N: No confidential data is exposed. VI:L: User-controlled settings (theme, homepage, column visibility) are modified, representing a low integrity impact. VA:N: No availability impact. SC/SI/SA:N: No impact on adjacent or downstream systems.","draft":false,"fixSummary":"The fix removes the three affected actions from the Security component's unlockedActions list (which had disabled all CSRF checks) and instead registers them under a header-only CSRF token validation mechanism (_csrfTokenHeaderOnly). This requires the X-CSRF-Token header to be present and valid on each request while still permitting the AJAX-style calls that lack traditional form fields. Client-side JavaScript and view templates are updated to include the X-CSRF-Token header (sourced from window.csrfToken) in all AJAX and fetch calls to these endpoints, ensuring legitimate same-origin requests continue to function while cross-origin forged requests are rejected.","generatedAt":"2026-09-14T08:59:52.615890Z","generator":"patch2vuln.py","model":"qwen3.8:27b","modelComparison":{"rankings":[{"agreementScore":9,"assumptionCount":4,"confidence":"medium","model":"qwen3.8:27b","score":6}],"selectedModel":"qwen3.8:27b","selectionMethod":"deterministic-consensus-v1","selectionNotice":"The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."},"patchSha256":"287bea96c3ef414dbe0e17b36a12cd0aed2f27c7b28ccc9867338fabf9561a0f","patchSummary":"In UserSettingsController::beforeFilter(), the three lines adding eventIndexColumnToggle, setTheme, and setHomePage to $this->Security->unlockedActions[] are removed and replaced with a single $this->_csrfTokenHeaderOnly() call covering all four affected actions (including setEventTemplateUserFormMode). In global_menu.ctp (default and UiBeta themes), navbar.ctp (Overmind theme), and misp.js, the jQuery $.ajax() and fetch() calls that invoke setTheme, setHomePage, and eventIndexColumnToggle are updated to include an X-CSRF-Token header populated from window.csrfToken. The Overmind navbar fetch calls also gain credentials: 'same-origin' to ensure cookies are sent with the request.","patchTruncated":false,"patches":[{"commit":"979337b182ae666fe1387342e20e061613657e83","patchSha256":"287bea96c3ef414dbe0e17b36a12cd0aed2f27c7b28ccc9867338fabf9561a0f","source":"https://github.com/MISP/MISP/commit/979337b18.patch","sourceUrl":"https://github.com/MISP/MISP/commit/979337b18.patch","subject":"fix: [security] Put the user-settings endpoints back under"}],"source":"https://github.com/MISP/MISP/commit/979337b18.patch","subject":"fix: [security] Put the user-settings endpoints back under","tagVersionBoundary":{"commits_after_fix":225,"repository":"https://github.com/MISP/MISP","tag":"v2.5.46","version":"2.5.46","version_type":"semver"},"weaknessRationale":[{"cweId":"CWE-352","rationale":"The endpoints were explicitly excluded from CSRF validation via the Security component's unlockedActions mechanism, allowing a cross-origin page to submit state-changing POST requests on behalf of an authenticated user without a valid CSRF token."}]}}},"recordType":"advisory","vulnId":"GCVE-1-2026-20226"}]}},"cveMetadata":{"assignerOrgId":"5a6e4751-2f3f-4070-9419-94fb35b644e8","assignerShortName":"CIRCL","cveId":"CVE-2026-90893","datePublished":"2026-09-14T09:12:03.863Z","dateReserved":"2026-09-14T09:12:01.736Z","dateUpdated":"2026-09-14T10:28:09.993Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-09-14 10:17:05","lastModifiedDate":"2026-09-14 11:17:07","problem_types":["CWE-352","CWE-352 CWE-352 Cross-Site Request Forgery (CSRF)"],"metrics":{"cvssMetricV40":[{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"ACTIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-14T10:26:31.868700Z","id":"CVE-2026-90893","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"90893","Ordinal":"1","Title":"MISP UserSettingsController CSRF Protection Bypass on setTheme, ","CVE":"CVE-2026-90893","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"90893","Ordinal":"1","NoteData":"MISP contains a Cross-Site Request Forgery (CSRF) vulnerability in the UserSettingsController. The actions setTheme, setHomePage, and eventIndexColumnToggle were explicitly added to the Security component's unlockedActions list, which disabled all CSRF validation (both token and field-hash checks) for those endpoints. Because these endpoints accept POST requests and modify per-user application state (theme selection, default homepage URL, and event index column visibility), an attacker who can induce a logged-in MISP user to load a malicious page (e.g., via a crafted link, embedded image, or auto-submitting form) can forge requests that alter the victim's settings without their knowledge or consent. The most impactful action is setHomePage, which allows an attacker to redirect the victim's default landing page to an arbitrary attacker-controlled URL, potentially facilitating phishing or further social engineering. The setTheme action can alter the user's visual theme, and eventIndexColumnToggle can change which columns are displayed in the event index view. No authentication bypass is involved; the victim must already be authenticated to MISP. The vulnerability was reported by the Scottish Government National Cyber Team.\n\nVersion affected: ≤2.5.45","Type":"Description","Title":"MISP UserSettingsController CSRF Protection Bypass on setTheme, "}]}}}