Affected versions of MISP expose several state-changing controller actions without restricting them to POST.
\nThe affected actions are:
- EventReportsController::purgeUnusedPictures()\n - NoticelistsController::enableNoticelist()\n - ServersController::removeOrphanedCorrelations()\n - WorkflowsController::rebuildRedis()
The patch adds allowMethod(['post']) to each action, preventing them from being triggered through ordinary GET requests.
For purgeUnusedPictures(), the corresponding UI previously used $.get(). The fix converts that request to POST and supplies X-CSRF-Token, while the controller enables header-only CSRF validation for that AJAX action.
Because GET requests can be induced cross-origin through links, images, redirects, or navigation, accepting GET for these state-changing operations can let an attacker trigger them using the authenticated victim's session.
Version affected: ≤2.5.45
The vulnerability is remediated by restricting all four state-changing actions to accept only POST requests via the CakePHP allowMethod() guard. Additionally, the client-side JavaScript for purgeUnusedPictures is updated to issue a POST request with the page's CSRF token in the X-CSRF-Token header, and a beforeFilter() hook is added to EventReportsController to configure header-only CSRF token validation for that specific action, since it is invoked via hand-built AJAX rather than a rendered form.
"}],"value":"The vulnerability is remediated by restricting all four state-changing actions to accept only POST requests via the CakePHP allowMethod() guard. Additionally, the client-side JavaScript for purgeUnusedPictures is updated to issue a POST request with the page's CSRF token in the X-CSRF-Token header, and a beforeFilter() hook is added to EventReportsController to configure header-only CSRF token validation for that specific action, since it is invoked via hand-built AJAX rather than a rendered form."}],"title":"MISP: State-changing actions accessible via GET request enabling CSRF","x_gcve":[{"extensions":{"bcp-05-x-01":{"ai_annotations":[{"ai_level":"generated","description":"Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.","gna_source":1,"models":[{"gna_source":1,"identifier":"qwen3.8:27b","name":"qwen3.8:27b","source":"ollama"}],"review_status":"review","scope":"record","tags":["ai-computer-assisted:llm-generated","ai-computer-assisted:classification"]}]},"bcp-05-x-02":{"x_patch2vuln":{"assumptions":["The fix commit is 196 commits before the v2.5.46 tag, implying the vulnerability existed in versions prior to v2.5.46; exact affected version range is not explicitly stated in the patch.","MISP requires user authentication to access the affected endpoints; the PR:L assumption is based on MISP's standard authentication model.","The CSRF token mechanism in CakePHP (the framework used by MISP) is assumed to protect POST requests but not GET requests, consistent with the patch's own comments.","The vulnerability was found during internal review and was not externally reported, per the commit message."],"commit":"b4a5486b5ddd078dc11248cbd7f21725fb1f43cf","confidence":"high","credits":[{"lang":"en","type":"remediation developer","value":"iglocska"},{"lang":"en","type":"remediation developer","value":"Claude Opus 5 (1M context)"}],"cvssRationale":"AV:N: The attack is delivered over the network (e.g., a malicious link or page). AC:L: No special race conditions or complex setup are required; a simple GET URL suffices. AT:N: No prior compromise or manipulation of the target system is needed. PR:L: The attacker requires the victim to be an authenticated MISP user; the attacker themselves need not be authenticated. UI:A: The victim must actively interact (click a link or navigate to a crafted page) to trigger the forged request. VC:N: No confidential data is exposed by the affected actions. VI:L: Integrity impact is low; the actions cause limited state changes (deleting unused pictures, toggling a noticelist, removing orphaned correlations, rebuilding a cache) rather than corrupting critical data. VA:N: No meaningful availability impact; the actions do not cause denial of service. SC/SI/SA:N: No impact on subsequent systems.","draft":false,"fixSummary":"The vulnerability is remediated by restricting all four state-changing actions to accept only POST requests via the CakePHP allowMethod() guard. Additionally, the client-side JavaScript for purgeUnusedPictures is updated to issue a POST request with the page's CSRF token in the X-CSRF-Token header, and a beforeFilter() hook is added to EventReportsController to configure header-only CSRF token validation for that specific action, since it is invoked via hand-built AJAX rather than a rendered form.","generatedAt":"2026-09-15T09:10:36.581856Z","generator":"patch2vuln.py","model":"qwen3.8:27b","modelComparison":{"rankings":[{"agreementScore":9,"assumptionCount":4,"confidence":"high","model":"qwen3.8:27b","score":7}],"selectedModel":"qwen3.8:27b","selectionMethod":"deterministic-consensus-v1","selectionNotice":"The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."},"patchSha256":"adc31514b96a99a411ca1ed5a31abf99642d19de3a09f536e62310b298d2552b","patchSummary":"Adds $this->request->allowMethod(['post']) to purgeUnusedPictures, enableNoticelist, removeOrphanedCorrelations, and rebuildRedis. Adds a beforeFilter() method to EventReportsController calling _csrfTokenHeaderOnly(['purgeUnusedPictures']) to permit CSRF token validation via the X-CSRF-Token header. Updates the managed_imported_pictures.ctp view to replace $.get() with $.ajax() using type 'post' and the X-CSRF-Token header. Adds REST response handling and flash/redirect logic to rebuildRedis for consistency with other actions.","patchTruncated":false,"patches":[{"commit":"b4a5486b5ddd078dc11248cbd7f21725fb1f43cf","patchSha256":"adc31514b96a99a411ca1ed5a31abf99642d19de3a09f536e62310b298d2552b","source":"https://github.com/MISP/MISP/commit/b4a5486b5.patch","sourceUrl":"https://github.com/MISP/MISP/commit/b4a5486b5.patch","subject":"fix: [security] Require POST for four remaining"}],"source":"https://github.com/MISP/MISP/commit/b4a5486b5.patch","subject":"fix: [security] Require POST for four remaining","tagVersionBoundary":{"commits_after_fix":196,"repository":"https://github.com/MISP/MISP","tag":"v2.5.46","version":"2.5.46","version_type":"semver"},"weaknessRationale":[{"cweId":"CWE-352","rationale":"The root cause is that state-changing endpoints accept GET requests, which are not protected by the framework's CSRF token mechanism. This allows an attacker to forge requests on behalf of an authenticated user via links, auto-loading resources, or other passive/active user interactions, which is the defining characteristic of CSRF."}]}}},"recordType":"advisory","vulnId":"GCVE-1-2026-20242"}]}},"cveMetadata":{"assignerOrgId":"5a6e4751-2f3f-4070-9419-94fb35b644e8","assignerShortName":"CIRCL","cveId":"CVE-2026-91857","datePublished":"2026-09-15T09:14:43.722Z","dateReserved":"2026-09-15T09:14:39.778Z","dateUpdated":"2026-09-15T13:19:25.134Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-09-15 10:17:06","lastModifiedDate":"2026-09-15 14:17:48","problem_types":["CWE-352","CWE-352 CWE-352 Cross-Site Request Forgery (CSRF)"],"metrics":{"cvssMetricV40":[{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-15T13:10:25.729586Z","id":"CVE-2026-91857","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"91857","Ordinal":"1","Title":"MISP: State-changing actions accessible via GET request enabling","CVE":"CVE-2026-91857","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"91857","Ordinal":"1","NoteData":"Affected versions of MISP expose several state-changing controller actions without restricting them to POST.\n\n\nThe affected actions are:\n\n\n\n - EventReportsController::purgeUnusedPictures()\n\n - NoticelistsController::enableNoticelist()\n\n - ServersController::removeOrphanedCorrelations()\n\n - WorkflowsController::rebuildRedis()\n\n\n\n\n\n\nThe patch adds allowMethod(['post']) to each action, preventing them from being triggered through ordinary GET requests.\n\n\nFor purgeUnusedPictures(), the corresponding UI previously used $.get(). The fix converts that request to POST and supplies X-CSRF-Token, while the controller enables header-only CSRF validation for that AJAX action.\n\n\nBecause GET requests can be induced cross-origin through links, images, redirects, or navigation, accepting GET for these state-changing operations can let an attacker trigger them using the authenticated victim's session.\n\nVersion affected: ≤2.5.45","Type":"Description","Title":"MISP: State-changing actions accessible via GET request enabling"}]}}}