MISP's WorkflowsController exposed the moduleStatelessExecution action in the Security component's unlockedActions list. In CakePHP, listing an action in unlockedActions disables both the CSRF token check and the field hash validation for that action. Because moduleStatelessExecution executes a workflow module's exec() method with caller-supplied input and parameters, the absence of CSRF protection allowed an attacker to craft a cross-site form post (or equivalent cross-origin request) that, when submitted by an authenticated site administrator, would cause the administrator's browser to invoke the action on the MISP instance.
The attacker could select any workflow module to execute, including action modules that write blocklist and warninglist entries, and supply arbitrary input and parameters of their choosing. This constitutes a cross-site request forgery (CSRF) vulnerability with high integrity impact on the MISP instance's security-related data.
The vulnerability was identified during an internal security review and was not externally reported. The fix is included in MISP v2.5.47.
"}],"value":"MISP's WorkflowsController exposed the moduleStatelessExecution action in the Security component's unlockedActions list. In CakePHP, listing an action in unlockedActions disables both the CSRF token check and the field hash validation for that action. Because moduleStatelessExecution executes a workflow module's exec() method with caller-supplied input and parameters, the absence of CSRF protection allowed an attacker to craft a cross-site form post (or equivalent cross-origin request) that, when submitted by an authenticated site administrator, would cause the administrator's browser to invoke the action on the MISP instance. \n\nThe attacker could select any workflow module to execute, including action modules that write blocklist and warninglist entries, and supply arbitrary input and parameters of their choosing. This constitutes a cross-site request forgery (CSRF) vulnerability with high integrity impact on the MISP instance's security-related data. \n\nThe vulnerability was identified during an internal security review and was not externally reported. The fix is included in MISP v2.5.47."}],"impacts":[{"capecId":"CAPEC-124","descriptions":[{"lang":"en","value":"CAPEC-124 Cross-Site Request Forgery"}]}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":6.9,"baseSeverity":"MEDIUM","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-352","description":"CWE-352 Cross-Site Request Forgery (CSRF)","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-09-22T12:31:23.222Z","orgId":"5a6e4751-2f3f-4070-9419-94fb35b644e8","shortName":"CIRCL"},"references":[{"name":"Security patch","tags":["patch"],"url":"https://github.com/MISP/MISP/commit/f05e0d1c2"}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"The moduleStatelessExecution action is removed from the unlockedActions list, restoring the CSRF token check. A new mechanism (_csrfTokenHeaderOnly) is introduced that enforces the CSRF token while exempting only the field hash, which the legitimate caller (the module dialog) cannot produce because it posts a hand-built object. The module dialog's AJAX request is updated to send the CSRF token in the X-CSRF-Token header, satisfying the token check without requiring a field hash.
"}],"value":"The moduleStatelessExecution action is removed from the unlockedActions list, restoring the CSRF token check. A new mechanism (_csrfTokenHeaderOnly) is introduced that enforces the CSRF token while exempting only the field hash, which the legitimate caller (the module dialog) cannot produce because it posts a hand-built object. The module dialog's AJAX request is updated to send the CSRF token in the X-CSRF-Token header, satisfying the token check without requiring a field hash."}],"title":"MISP CSRF vulnerability in workflow moduleStatelessExecution allows cross-site execution of workflow modules","x_gcve":[{"extensions":{"bcp-05-x-01":{"ai_annotations":[{"ai_level":"generated","description":"Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.","gna_source":1,"models":[{"gna_source":1,"identifier":"qwen3.8:27b","name":"qwen3.8:27b","source":"ollama"}],"review_status":"full","scope":"record","tags":["ai-computer-assisted:llm-generated","ai-computer-assisted:classification"]}]},"bcp-05-x-02":{"x_patch2vuln":{"assumptions":["The affected version range is inferred from the tag_version_boundary metadata (v2.5.47, 6 commits after fix), implying the fix is included in v2.5.47 and prior versions are affected. The exact introduction version of the vulnerable code is unknown.","UI:A is used because the CSRF attack requires the victim to actively navigate to the attacker's page or click a link; a purely passive load (e.g., embedded iframe auto-submit) would map to UI:P, but the commit message describes a 'cross-site form post' which typically requires at least a page visit.","SI:N is chosen because the evidence only demonstrates integrity impact on MISP's own blocklist and warninglist data; no evidence supports impact on downstream or external systems.","The CAPEC-124 mapping is confident based on the explicit description of a cross-site form post in the commit message.","The commit message states the issue was 'found during the internal review, not externally reported,' but does not explicitly name a finder; therefore no finder credit is assigned.","The _csrfTokenHeaderOnly method is referenced in the patch but its implementation is not shown; it is assumed to enforce CSRF token validation while exempting the field hash, as described in the commit message."],"capecRationale":[{"capecId":"CAPEC-124","rationale":"The attack pattern described in the commit message is a cross-site form post that causes an authenticated site admin to execute a workflow module with attacker-chosen parameters. This maps directly to CAPEC-124, which describes an attacker exploiting the trust a web application places in a user's browser session to perform unauthorized actions. The mapping is confident because the commit message explicitly describes a cross-site form post bypassing CSRF protection."}],"commit":"f05e0d1c263b211108644fe6f1600ad7fde9b915","confidence":"high","credits":[{"lang":"en","type":"remediation developer","value":"iglocska"},{"lang":"en","type":"remediation developer","value":"Claude Opus 5 (1M context)"}],"cvssRationale":"AV:N: The attack is delivered over the network via a malicious web page. AC:L: Crafting a cross-site form post is straightforward. AT:N: No special conditions or timing are required. PR:N: The attacker requires no account or privileges on the MISP instance. UI:A: The victim (a site admin) must actively visit the attacker-controlled page or click a link that triggers the form submission. VC:N: No confidentiality impact is evident. VI:H: The attacker can write arbitrary blocklist and warninglist entries, significantly compromising the integrity of MISP's security data. VA:N: No availability impact. SC/SI/SA:N: No evidence of impact on other systems beyond MISP itself.","fixSummary":"The moduleStatelessExecution action is removed from the unlockedActions list, restoring the CSRF token check. A new mechanism (_csrfTokenHeaderOnly) is introduced that enforces the CSRF token while exempting only the field hash, which the legitimate caller (the module dialog) cannot produce because it posts a hand-built object. The module dialog's AJAX request is updated to send the CSRF token in the X-CSRF-Token header, satisfying the token check without requiring a field hash.","generatedAt":"2026-09-22T12:15:58.553959Z","generator":"patch2vuln.py","model":"qwen3.8:27b","modelComparison":{"rankings":[{"agreementScore":9,"assumptionCount":6,"confidence":"high","model":"qwen3.8:27b","score":5}],"selectedModel":"qwen3.8:27b","selectionMethod":"deterministic-consensus-v1","selectionNotice":"The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."},"patchSha256":"3f8a00ca29761ed6a3986633e60ec67a964e3bfc1dc1e2631a2c2d80df827d30","patchSummary":"In WorkflowsController::beforeFilter(), the line adding 'moduleStatelessExecution' to $this->Security->unlockedActions is replaced with a call to $this->_csrfTokenHeaderOnly(['moduleStatelessExecution']), which enforces CSRF token validation while waiving only the field hash requirement. In execute_module.ctp, the jQuery $.ajax() call is modified to include the header 'X-CSRF-Token' populated from window.csrfToken, so the legitimate client-side caller passes the token check via the header rather than a form field.","patchTruncated":false,"patches":[{"commit":"f05e0d1c263b211108644fe6f1600ad7fde9b915","patchSha256":"3f8a00ca29761ed6a3986633e60ec67a964e3bfc1dc1e2631a2c2d80df827d30","source":"https://github.com/MISP/MISP/commit/f05e0d1c2.patch","sourceUrl":"https://github.com/MISP/MISP/commit/f05e0d1c2.patch","subject":"fix: [security] Keep the CSRF check on stateless workflow"}],"source":"https://github.com/MISP/MISP/commit/f05e0d1c2.patch","subject":"fix: [security] Keep the CSRF check on stateless workflow","tagVersionBoundary":{"commits_after_fix":6,"repository":"https://github.com/MISP/MISP","tag":"v2.5.47","version":"2.5.47","version_type":"semver"},"weaknessRationale":[{"cweId":"CWE-352","rationale":"The vulnerable action was placed in unlockedActions, which disabled the CSRF token check. This allowed a cross-site form post to trigger a state-changing action (workflow module execution) on behalf of an authenticated administrator, which is the textbook definition of CSRF."}]}}},"recordType":"advisory","vulnId":"GCVE-1-2026-20261"}]}},"cveMetadata":{"assignerOrgId":"5a6e4751-2f3f-4070-9419-94fb35b644e8","assignerShortName":"CIRCL","cveId":"CVE-2026-95658","datePublished":"2026-09-22T12:31:23.222Z","dateReserved":"2026-09-22T12:31:20.344Z","dateUpdated":"2026-09-22T15:35:08.313Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-09-22 13:17:13","lastModifiedDate":"2026-09-22 16:18:19","problem_types":["CWE-352","CWE-352 CWE-352 Cross-Site Request Forgery (CSRF)"],"metrics":{"cvssMetricV40":[{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"ACTIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-22T15:34:56.912472Z","id":"CVE-2026-95658","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"95658","Ordinal":"1","Title":"MISP CSRF vulnerability in workflow moduleStatelessExecution all","CVE":"CVE-2026-95658","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"95658","Ordinal":"1","NoteData":"MISP's WorkflowsController exposed the moduleStatelessExecution action in the Security component's unlockedActions list. In CakePHP, listing an action in unlockedActions disables both the CSRF token check and the field hash validation for that action. Because moduleStatelessExecution executes a workflow module's exec() method with caller-supplied input and parameters, the absence of CSRF protection allowed an attacker to craft a cross-site form post (or equivalent cross-origin request) that, when submitted by an authenticated site administrator, would cause the administrator's browser to invoke the action on the MISP instance. \n\nThe attacker could select any workflow module to execute, including action modules that write blocklist and warninglist entries, and supply arbitrary input and parameters of their choosing. This constitutes a cross-site request forgery (CSRF) vulnerability with high integrity impact on the MISP instance's security-related data. \n\nThe vulnerability was identified during an internal security review and was not externally reported. The fix is included in MISP v2.5.47.","Type":"Description","Title":"MISP CSRF vulnerability in workflow moduleStatelessExecution all"}]}}}