{"id":"CVE-2026-91857","summary":"MISP: State-changing actions accessible via GET request enabling CSRF","details":"Affected versions of MISP expose several state-changing controller actions without restricting them to POST.\n\n\nThe affected actions are:\n\n\n\n - EventReportsController::purgeUnusedPictures()\n\n - NoticelistsController::enableNoticelist()\n\n - ServersController::removeOrphanedCorrelations()\n\n - WorkflowsController::rebuildRedis()\n\n\n\n\n\n\nThe patch adds allowMethod(['post']) to each action, preventing them from being triggered through ordinary GET requests.\n\n\nFor purgeUnusedPictures(), the corresponding UI previously used $.get(). The fix converts that request to POST and supplies X-CSRF-Token, while the controller enables header-only CSRF validation for that AJAX action.\n\n\nBecause GET requests can be induced cross-origin through links, images, redirects, or navigation, accepting GET for these state-changing operations can let an attacker trigger them using the authenticated victim's session.\n\nVersion affected: ≤2.5.45","modified":"2026-09-18T03:30:20.665694297Z","published":"2026-09-15T09:14:43.722Z","database_specific":{"cwe_ids":["CWE-352"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91857.json","cna_assigner":"CIRCL"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91857.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91857"},{"type":"FIX","url":"https://github.com/MISP/MISP/commit/b4a5486b5"},{"type":"PACKAGE","url":"https://github.com/MISP/MISP"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/misp/misp","events":[{"introduced":"0"},{"fixed":"b4a5486b5"}],"database_specific":{"source":["AFFECTED_FIELD","REFERENCES"],"extracted_events":[{"introduced":"0"},{"fixed":"2.5.46"}]}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-91857.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N"}]}