Common Weakness Enumeration
CWE-352
AllowedCross-Site Request Forgery (CSRF)
Abstraction: Compound · Status: Stable
The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
14671 vulnerabilities reference this CWE, most recent first.
CVE-2026-22202 (GCVE-0-2026-22202)
Vulnerability from cvelistv5 – Published: 2026-03-13 01:18 – Updated: 2026-03-13 16:08
VLAI
EPSS
VEX
Title
wpDiscuz before 7.6.47 - Destructive GET Action Deletes All Comments by Email
Summary
wpDiscuz before 7.6.47 contains a cross-site request forgery vulnerability that allows attackers to delete all comments associated with an email address by crafting a malicious GET request with a valid HMAC key. Attackers can embed the deletecomments action URL in image tags or other resources to trigger permanent deletion of comments without user confirmation or POST-based CSRF protection.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-03-13 16:08 UTC
CWE
- CWE-352 - Cross-Site Request Forgery (CSRF)
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://wordpress.org/plugins/wpdiscuz/#developers | patch |
| https://wordpress.org/plugins/wpdiscuz/ | product |
| https://www.vulncheck.com/advisories/wpdiscuz-bef… | third-party-advisory |
Impacted products
Date Public
2026-03-11 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-22202",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-13T16:08:54.168484Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-13T16:08:59.351Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:wordpress-plugin/wpdiscuz",
"product": "wpDiscuz",
"vendor": "gVectors",
"versions": [
{
"lessThan": "7.6.47",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "7.6.47"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:gvectors:wpdiscuz:*:*:*:*:*:wordpress:*:*",
"versionEndExcluding": "7.6.47",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Scott Moore - VulnCheck"
}
],
"datePublic": "2026-03-11T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "wpDiscuz before 7.6.47 contains a cross-site request forgery vulnerability that allows attackers to delete all comments associated with an email address by crafting a malicious GET request with a valid HMAC key. Attackers can embed the deletecomments action URL in image tags or other resources to trigger permanent deletion of comments without user confirmation or POST-based CSRF protection."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "Cross-Site Request Forgery (CSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-13T01:18:08.762Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "wpDiscuz Changelog",
"tags": [
"patch"
],
"url": "https://wordpress.org/plugins/wpdiscuz/#developers"
},
{
"name": "wpDiscuz",
"tags": [
"product"
],
"url": "https://wordpress.org/plugins/wpdiscuz/"
},
{
"name": "VulnCheck Advisory: wpDiscuz before 7.6.47 - Destructive GET Action Deletes All Comments by Email",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/wpdiscuz-before-destructive-get-action-deletes-all-comments-by-email"
}
],
"title": "wpDiscuz before 7.6.47 - Destructive GET Action Deletes All Comments by Email",
"x_generator": {
"engine": "scooter"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-22202",
"datePublished": "2026-03-13T01:18:08.762Z",
"dateReserved": "2026-01-06T16:47:17.185Z",
"dateUpdated": "2026-03-13T16:08:59.351Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-22194 (GCVE-0-2026-22194)
Vulnerability from cvelistv5 – Published: 2026-01-09 16:17 – Updated: 2026-05-25 23:41
VLAI
EPSS
VEX
Title
GestSup <= 3.2.60 CSRF Allows Privileged Actions
Summary
GestSup versions up to and including 3.2.60 contain a cross-site request forgery (CSRF) vulnerability where the application does not verify the authenticity of client requests. An attacker can induce a logged-in user to submit crafted requests that perform actions with the victim's privileges. This can be exploited to create privileged accounts by targeting the administrative user creation endpoint.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-01-09 17:48 UTC
CWE
- CWE-352 - Cross-Site Request Forgery (CSRF)
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://gestsup.fr/index.php?page=changelog | release-notes |
| https://www.vulncheck.com/advisories/gestsup-csrf… | third-party-advisory |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-22194",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-09T17:48:17.494091Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-01-09T18:37:37.903Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "GestSup",
"vendor": "GestSup",
"versions": [
{
"lessThanOrEqual": "3.2.60",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:gestsup:gestsup:*:*:*:*:*:*:*:*",
"versionEndIncluding": "3.2.60",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Geoffrey Robert and Valentin Holubec of Akailabs"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulnCheck"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "GestSup versions up to and including 3.2.60 contain a cross-site request forgery (CSRF) vulnerability where the application does not verify the authenticity of client requests. An attacker can induce a logged-in user to submit crafted requests that perform actions with the victim\u0027s privileges. This can be exploited to create privileged accounts by targeting the administrative user creation endpoint.\u003cbr\u003e"
}
],
"value": "GestSup versions up to and including 3.2.60 contain a cross-site request forgery (CSRF) vulnerability where the application does not verify the authenticity of client requests. An attacker can induce a logged-in user to submit crafted requests that perform actions with the victim\u0027s privileges. This can be exploited to create privileged accounts by targeting the administrative user creation endpoint."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.9,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "HIGH",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "CWE-352 Cross-Site Request Forgery (CSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-25T23:41:35.851Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"release-notes"
],
"url": "https://gestsup.fr/index.php?page=changelog"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/gestsup-csrf-allows-privileged-actions"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "GestSup \u003c= 3.2.60 CSRF Allows Privileged Actions",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-22194",
"datePublished": "2026-01-09T16:17:55.920Z",
"dateReserved": "2026-01-06T16:47:17.184Z",
"dateUpdated": "2026-05-25T23:41:35.851Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-22030 (GCVE-0-2026-22030)
Vulnerability from cvelistv5 – Published: 2026-01-10 02:42 – Updated: 2026-01-12 18:09
VLAI
EPSS
VEX
Title
React Router has CSRF issue in Action/Server Action Request Processing
Summary
React Router is a router for React. In @remix-run/server-runtime version prior to 2.17.3. and react-router 7.0.0 through 7.11.0, React Router (or Remix v2) is vulnerable to CSRF attacks on document POST requests to UI routes when using server-side route action handlers in Framework Mode, or when using React Server Actions in the new unstable RSC modes. There is no impact if Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>) is being used. This issue has been patched in @remix-run/server-runtime version 2.17.3 and react-router version 7.12.0.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-01-12 18:09 UTC
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/remix-run/react-router/securit… | x_refsource_CONFIRM |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| remix-run | react-router |
Affected:
@remix-run/router < 2.17.3
Affected: react-router >= 7.0.0, < 7.12.0 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-22030",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-12T18:09:33.609212Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-01-12T18:09:39.441Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "react-router",
"vendor": "remix-run",
"versions": [
{
"status": "affected",
"version": "@remix-run/router \u003c 2.17.3"
},
{
"status": "affected",
"version": "react-router \u003e= 7.0.0, \u003c 7.12.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "React Router is a router for React. In @remix-run/server-runtime version prior to 2.17.3. and react-router 7.0.0 through 7.11.0, React Router (or Remix v2) is vulnerable to CSRF attacks on document POST requests to UI routes when using server-side route action handlers in Framework Mode, or when using React Server Actions in the new unstable RSC modes. There is no impact if Declarative Mode (\u003cBrowserRouter\u003e) or Data Mode (createBrowserRouter/\u003cRouterProvider\u003e) is being used. This issue has been patched in @remix-run/server-runtime version 2.17.3 and react-router version 7.12.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-346",
"description": "CWE-346: Origin Validation Error",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "CWE-352: Cross-Site Request Forgery (CSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-01-10T02:42:44.603Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/remix-run/react-router/security/advisories/GHSA-h5cw-625j-3rxh",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/remix-run/react-router/security/advisories/GHSA-h5cw-625j-3rxh"
}
],
"source": {
"advisory": "GHSA-h5cw-625j-3rxh",
"discovery": "UNKNOWN"
},
"title": "React Router has CSRF issue in Action/Server Action Request Processing"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-22030",
"datePublished": "2026-01-10T02:42:44.603Z",
"dateReserved": "2026-01-05T22:30:38.718Z",
"dateUpdated": "2026-01-12T18:09:39.441Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-21430 (GCVE-0-2026-21430)
Vulnerability from cvelistv5 – Published: 2026-01-02 18:44 – Updated: 2026-01-05 20:38
VLAI
EPSS
VEX
Title
Emlog: CSRF chained with stored XSS leads to ATO
Summary
Emlog is an open source website building system. In version 2.5.23, article creation functionality is vulnerable to cross-site request forgery (CSRF). This can lead to a user being forced to post an article with arbitrary, attacker-controlled content. This, when combined with stored cross-site scripting, leads to account takeover. As of time of publication, no known patched versions are available.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-01-05 20:32 UTC
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/emlog/emlog/security/advisorie… | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-21430",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-05T20:32:31.928774Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-01-05T20:38:09.299Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "emlog",
"vendor": "emlog",
"versions": [
{
"status": "affected",
"version": "= 2.5.23"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Emlog is an open source website building system. In version 2.5.23, article creation functionality is vulnerable to cross-site request forgery (CSRF). This can lead to a user being forced to post an article with arbitrary, attacker-controlled content. This, when combined with stored cross-site scripting, leads to account takeover. As of time of publication, no known patched versions are available."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "HIGH",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:P",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "CWE-352: Cross-Site Request Forgery (CSRF)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-01-02T18:44:24.192Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/emlog/emlog/security/advisories/GHSA-2g2w-vmg7-pq4q",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/emlog/emlog/security/advisories/GHSA-2g2w-vmg7-pq4q"
}
],
"source": {
"advisory": "GHSA-2g2w-vmg7-pq4q",
"discovery": "UNKNOWN"
},
"title": "Emlog: CSRF chained with stored XSS leads to ATO"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-21430",
"datePublished": "2026-01-02T18:44:24.192Z",
"dateReserved": "2025-12-29T03:00:29.274Z",
"dateUpdated": "2026-01-05T20:38:09.299Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-20704 (GCVE-0-2026-20704)
Vulnerability from cvelistv5 – Published: 2026-02-03 06:56 – Updated: 2026-05-12 08:09
VLAI
EPSS
VEX
Summary
Cross-site request forgery vulnerability exists in ELECOM wireless LAN products. If a user accesses a malicious page while logged-in to the affected product, unintended operations may be performed.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-02-03 15:55 UTC
CWE
- CWE-352 - Cross-site request forgery (CSRF)
Assigner
References
2 references
Impacted products
15 products
| Vendor | Product | Version | |
|---|---|---|---|
| ELECOM CO.,LTD. | WRC-X1500GS-B |
Affected:
v1.12 and earlier
|
|
| ELECOM CO.,LTD. | WRC-X1500GSA-B |
Affected:
v1.12 and earlier
|
|
| ELECOM CO.,LTD. | WRC-X3000GS2-B |
Affected:
v1.09 and earlier
|
|
| ELECOM CO.,LTD. | WRC-X3000GS2-W |
Affected:
v1.09 and earlier
|
|
| ELECOM CO.,LTD. | WRC-X3000GS2A-B |
Affected:
v1.09 and earlier
|
|
| ELECOM CO.,LTD. | WRC-X3000GST2-B |
Affected:
v1.06 and earlier
|
|
| ELECOM CO.,LTD. | WRC-X1800GS-B |
Affected:
v1.19 and earlier
|
|
| ELECOM CO.,LTD. | WRC-X1800GSA-B |
Affected:
v1.19 and earlier
|
|
| ELECOM CO.,LTD. | WRC-X1800GSH-B |
Affected:
v1.19 and earlier
|
|
| ELECOM CO.,LTD. | WRC-X6000QS-G |
Affected:
v1.14 and earlier
|
|
| ELECOM CO.,LTD. | WRC-X6000QSA-G |
Affected:
v1.14 and earlier
|
|
| ELECOM CO.,LTD. | WRC-X6000XS-G |
Affected:
v1.12 and earlier
|
|
| ELECOM CO.,LTD. | WRC-X6000XST-G |
Affected:
v1.16 and earlier
|
|
| ELECOM CO.,LTD. | WRC-XE5400GS-G |
Affected:
v1.13 and earlier
|
|
| ELECOM CO.,LTD. | WRC-XE5400GSA-G |
Affected:
v1.13 and earlier
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-20704",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-02-03T15:55:57.052296Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-02-03T15:56:26.479Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "WRC-X1500GS-B",
"vendor": "ELECOM CO.,LTD.",
"versions": [
{
"status": "affected",
"version": "v1.12 and earlier"
}
]
},
{
"product": "WRC-X1500GSA-B",
"vendor": "ELECOM CO.,LTD.",
"versions": [
{
"status": "affected",
"version": "v1.12 and earlier"
}
]
},
{
"product": "WRC-X3000GS2-B",
"vendor": "ELECOM CO.,LTD.",
"versions": [
{
"status": "affected",
"version": "v1.09 and earlier"
}
]
},
{
"product": "WRC-X3000GS2-W",
"vendor": "ELECOM CO.,LTD.",
"versions": [
{
"status": "affected",
"version": "v1.09 and earlier"
}
]
},
{
"product": "WRC-X3000GS2A-B",
"vendor": "ELECOM CO.,LTD.",
"versions": [
{
"status": "affected",
"version": "v1.09 and earlier"
}
]
},
{
"product": "WRC-X3000GST2-B",
"vendor": "ELECOM CO.,LTD.",
"versions": [
{
"status": "affected",
"version": "v1.06 and earlier"
}
]
},
{
"product": "WRC-X1800GS-B",
"vendor": "ELECOM CO.,LTD.",
"versions": [
{
"status": "affected",
"version": "v1.19 and earlier"
}
]
},
{
"product": "WRC-X1800GSA-B",
"vendor": "ELECOM CO.,LTD.",
"versions": [
{
"status": "affected",
"version": "v1.19 and earlier"
}
]
},
{
"product": "WRC-X1800GSH-B",
"vendor": "ELECOM CO.,LTD.",
"versions": [
{
"status": "affected",
"version": "v1.19 and earlier"
}
]
},
{
"product": "WRC-X6000QS-G",
"vendor": "ELECOM CO.,LTD.",
"versions": [
{
"status": "affected",
"version": "v1.14 and earlier"
}
]
},
{
"product": "WRC-X6000QSA-G",
"vendor": "ELECOM CO.,LTD.",
"versions": [
{
"status": "affected",
"version": "v1.14 and earlier"
}
]
},
{
"product": "WRC-X6000XS-G",
"vendor": "ELECOM CO.,LTD.",
"versions": [
{
"status": "affected",
"version": "v1.12 and earlier"
}
]
},
{
"product": "WRC-X6000XST-G",
"vendor": "ELECOM CO.,LTD.",
"versions": [
{
"status": "affected",
"version": "v1.16 and earlier"
}
]
},
{
"product": "WRC-XE5400GS-G",
"vendor": "ELECOM CO.,LTD.",
"versions": [
{
"status": "affected",
"version": "v1.13 and earlier"
}
]
},
{
"product": "WRC-XE5400GSA-G",
"vendor": "ELECOM CO.,LTD.",
"versions": [
{
"status": "affected",
"version": "v1.13 and earlier"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross-site request forgery vulnerability exists in ELECOM wireless LAN products. If a user accesses a malicious page while logged-in to the affected product, unintended operations may be performed."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"version": "3.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "Cross-site request forgery (CSRF)",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-12T08:09:07.849Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://www.elecom.co.jp/news/security/20260203-01/"
},
{
"url": "https://jvn.jp/en/jp/JVN94012927/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2026-20704",
"datePublished": "2026-02-03T06:56:42.019Z",
"dateReserved": "2026-01-30T01:42:47.600Z",
"dateUpdated": "2026-05-12T08:09:07.849Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-20296 (GCVE-0-2026-20296)
Vulnerability from cvelistv5 – Published: 2026-07-15 17:18 – Updated: 2026-07-16 03:55
VLAI
EPSS
VEX
Title
SPL Command Safeguards Bypass through Cross-Site Request Forgery (CSRF) in Deployment Server in Splunk Enterprise
Summary
In Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.8, and 9.4.13, and Splunk Cloud Platform versions below 10.5.2605.0, 10.4.2604.7, 10.3.2512.16, 10.2.2510.18, and 10.1.2507.24, an attacker could trick a user that holds a role with the `list_deployment_server` capability into running arbitrary Search Processing Language (SPL) searches on their behalf as `splunk-system-user`, allowing for access to stored credentials and indexed data.<br><br>The vulnerability is possible because Deployment Server endpoints in Splunk Web do not validate Cross-Site Request Forgery (CSRF) tokens on GET requests, and caller-supplied input is not correctly neutralized before it is placed into an SPL search.
Severity
8.3 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-15 00:00 UTC
CWE
- CWE-352 - The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Splunk | Splunk Enterprise |
Affected:
10.4 , < 10.4.1
(custom)
Affected: 10.2 , < 10.2.5 (custom) Affected: 10.0 , < 10.0.8 (custom) Affected: 9.4 , < 9.4.13 (custom) |
|
| Splunk | Splunk Cloud Platform |
Affected:
10.5.2605 , < 10.5.2605.0
(custom)
Affected: 10.4.2604 , < 10.4.2604.7 (custom) Affected: 10.3.2512 , < 10.3.2512.16 (custom) Affected: 10.2.2510 , < 10.2.2510.18 (custom) Affected: 10.1.2507 , < 10.1.2507.24 (custom) |
Date Public
2026-07-15 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-20296",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-15T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-16T03:55:54.695Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Splunk Enterprise",
"vendor": "Splunk",
"versions": [
{
"lessThan": "10.4.1",
"status": "affected",
"version": "10.4",
"versionType": "custom"
},
{
"lessThan": "10.2.5",
"status": "affected",
"version": "10.2",
"versionType": "custom"
},
{
"lessThan": "10.0.8",
"status": "affected",
"version": "10.0",
"versionType": "custom"
},
{
"lessThan": "9.4.13",
"status": "affected",
"version": "9.4",
"versionType": "custom"
}
]
},
{
"product": "Splunk Cloud Platform",
"vendor": "Splunk",
"versions": [
{
"lessThan": "10.5.2605.0",
"status": "affected",
"version": "10.5.2605",
"versionType": "custom"
},
{
"lessThan": "10.4.2604.7",
"status": "affected",
"version": "10.4.2604",
"versionType": "custom"
},
{
"lessThan": "10.3.2512.16",
"status": "affected",
"version": "10.3.2512",
"versionType": "custom"
},
{
"lessThan": "10.2.2510.18",
"status": "affected",
"version": "10.2.2510",
"versionType": "custom"
},
{
"lessThan": "10.1.2507.24",
"status": "affected",
"version": "10.1.2507",
"versionType": "custom"
}
]
}
],
"datePublic": "2026-07-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "In Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.8, and 9.4.13, and Splunk Cloud Platform versions below 10.5.2605.0, 10.4.2604.7, 10.3.2512.16, 10.2.2510.18, and 10.1.2507.24, an attacker could trick a user that holds a role with the `list_deployment_server` capability into running arbitrary Search Processing Language (SPL) searches on their behalf as `splunk-system-user`, allowing for access to stored credentials and indexed data.\u003cbr\u003e\u003cbr\u003eThe vulnerability is possible because Deployment Server endpoints in Splunk Web do not validate Cross-Site Request Forgery (CSRF) tokens on GET requests, and caller-supplied input is not correctly neutralized before it is placed into an SPL search."
}
],
"value": "In Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.8, and 9.4.13, and Splunk Cloud Platform versions below 10.5.2605.0, 10.4.2604.7, 10.3.2512.16, 10.2.2510.18, and 10.1.2507.24, an attacker could trick a user that holds a role with the `list_deployment_server` capability into running arbitrary Search Processing Language (SPL) searches on their behalf as `splunk-system-user`, allowing for access to stored credentials and indexed data.\u003cbr\u003e\u003cbr\u003eThe vulnerability is possible because Deployment Server endpoints in Splunk Web do not validate Cross-Site Request Forgery (CSRF) tokens on GET requests, and caller-supplied input is not correctly neutralized before it is placed into an SPL search."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.",
"lang": "en",
"type": "cwe"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-15T17:18:23.696Z",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"url": "https://advisory.splunk.com/advisories/SVD-2026-0702"
}
],
"source": {
"advisory": "SVD-2026-0702"
},
"title": "SPL Command Safeguards Bypass through Cross-Site Request Forgery (CSRF) in Deployment Server in Splunk Enterprise"
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2026-20296",
"datePublished": "2026-07-15T17:18:23.696Z",
"dateReserved": "2025-10-08T11:59:15.407Z",
"dateUpdated": "2026-07-16T03:55:54.695Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
GCVE-1-2026-20261 (CVE-2026-95658)
Vulnerability from gna-1 – Published: 2026-09-22 12:31 – Updated: 2026-09-22 12:31
VLAI
EPSS
VEX
Title
MISP CSRF vulnerability in workflow moduleStatelessExecution allows cross-site execution of workflow modules
Summary
MISP's WorkflowsController exposed the moduleStatelessExecution action in the Security component's unlockedActions list. In CakePHP, listing an action in unlockedActions disables both the CSRF token check and the field hash validation for that action. Because moduleStatelessExecution executes a workflow module's exec() method with caller-supplied input and parameters, the absence of CSRF protection allowed an attacker to craft a cross-site form post (or equivalent cross-origin request) that, when submitted by an authenticated site administrator, would cause the administrator's browser to invoke the action on the MISP instance.
The attacker could select any workflow module to execute, including action modules that write blocklist and warninglist entries, and supply arbitrary input and parameters of their choosing. This constitutes a cross-site request forgery (CSRF) vulnerability with high integrity impact on the MISP instance's security-related data.
The vulnerability was identified during an internal security review and was not externally reported. The fix is included in MISP v2.5.47.
Severity
CWE
- CWE-352 - Cross-Site Request Forgery (CSRF)
Assigner
GNA-1
This instance
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/MISP/MISP/commit/f05e0d1c2 | patch |
GCVE extensions
AI-generated
Human-reviewed
Confidence: high
Model
qwen3.8:27b
advisory
bcp-05-x-01bcp-05-x-02
AI involvement
GCVE-BCP-05-X-01
Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.
ai-computer-assisted:llm-generatedai-computer-assisted:classification
| Model | Source | Identifier |
|---|---|---|
| qwen3.8:27b | ollama | qwen3.8:27b |
Patch provenance
GCVE-BCP-05-X-02
- Generator
-
patch2vuln.pyon 2026-09-22 12:15 - Model
qwen3.8:27b- Input
-
https://github.com/MISP/MISP/commit/f05e0d1c2.patch
3f8a00ca2976… - Confidence
- high
| Commit | Subject | Patch SHA-256 |
|---|---|---|
f05e0d1c263b
|
fix: [security] Keep the CSRF check on stateless workflow | 3f8a00ca2976… |
Fix summary
The moduleStatelessExecution action is removed from the unlockedActions list, restoring the CSRF token check. A new mechanism (_csrfTokenHeaderOnly) is introduced that enforces the CSRF token while exempting only the field hash, which the legitimate caller (the module dialog) cannot produce because it posts a hand-built object. The module dialog's AJAX request is updated to send the CSRF token in the X-CSRF-Token header, satisfying the token check without requiring a field hash.
Patch summary
In WorkflowsController::beforeFilter(), the line adding 'moduleStatelessExecution' to $this->Security->unlockedActions is replaced with a call to $this->_csrfTokenHeaderOnly(['moduleStatelessExecution']), which enforces CSRF token validation while waiving only the field hash requirement. In execute_module.ctp, the jQuery $.ajax() call is modified to include the header 'X-CSRF-Token' populated from window.csrfToken, so the legitimate client-side caller passes the token check via the header rather than a form field.
CVSS rationale
AV:N: The attack is delivered over the network via a malicious web page. AC:L: Crafting a cross-site form post is straightforward. AT:N: No special conditions or timing are required. PR:N: The attacker requires no account or privileges on the MISP instance. UI:A: The victim (a site admin) must actively visit the attacker-controlled page or click a link that triggers the form submission. VC:N: No confidentiality impact is evident. VI:H: The attacker can write arbitrary blocklist and warninglist entries, significantly compromising the integrity of MISP's security data. VA:N: No availability impact. SC/SI/SA:N: No evidence of impact on other systems beyond MISP itself.
Weakness rationale
- CWE-352 The vulnerable action was placed in unlockedActions, which disabled the CSRF token check. This allowed a cross-site form post to trigger a state-changing action (workflow module execution) on behalf of an authenticated administrator, which is the textbook definition of CSRF.
Attack pattern rationale
- CAPEC-124 The attack pattern described in the commit message is a cross-site form post that causes an authenticated site admin to execute a workflow module with attacker-chosen parameters. This maps directly to CAPEC-124, which describes an attacker exploiting the trust a web application places in a user's browser session to perform unauthorized actions. The mapping is confident because the commit message explicitly describes a cross-site form post bypassing CSRF protection.
Assumptions to verify
- The affected version range is inferred from the tag_version_boundary metadata (v2.5.47, 6 commits after fix), implying the fix is included in v2.5.47 and prior versions are affected. The exact introduction version of the vulnerable code is unknown.
- UI:A is used because the CSRF attack requires the victim to actively navigate to the attacker's page or click a link; a purely passive load (e.g., embedded iframe auto-submit) would map to UI:P, but the commit message describes a 'cross-site form post' which typically requires at least a page visit.
- SI:N is chosen because the evidence only demonstrates integrity impact on MISP's own blocklist and warninglist data; no evidence supports impact on downstream or external systems.
- The CAPEC-124 mapping is confident based on the explicit description of a cross-site form post in the commit message.
- The commit message states the issue was 'found during the internal review, not externally reported,' but does not explicitly name a finder; therefore no finder credit is assigned.
- The _csrfTokenHeaderOnly method is referenced in the patch but its implementation is not shown; it is assumed to enforce CSRF token validation while exempting the field hash, as described in the commit message.
Model comparison
Selected qwen3.8:27b
by deterministic-consensus-v1
The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required.
| Model | Score | Agreement | Confidence | Assumptions |
|---|---|---|---|---|
qwen3.8:27b |
5 | 9 | high | 6 |
{
"containers": {
"cna": {
"affected": [
{
"modules": [
"WorkflowsController",
"Workflows module execution"
],
"product": "MISP",
"programFiles": [
"app/Controller/WorkflowsController.php",
"app/View/Elements/Workflows/execute_module.ctp"
],
"repo": "https://github.com/MISP/MISP",
"vendor": "MISP",
"versions": [
{
"lessThan": "2.5.47",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "remediation developer",
"value": "iglocska"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Claude Opus 5 (1M context)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eMISP\u0027s WorkflowsController exposed the moduleStatelessExecution action in the Security component\u0027s unlockedActions list. In CakePHP, listing an action in unlockedActions disables both the CSRF token check and the field hash validation for that action. Because moduleStatelessExecution executes a workflow module\u0027s exec() method with caller-supplied input and parameters, the absence of CSRF protection allowed an attacker to craft a cross-site form post (or equivalent cross-origin request) that, when submitted by an authenticated site administrator, would cause the administrator\u0027s browser to invoke the action on the MISP instance.\u0026nbsp;\u003c/p\u003e\u003cp\u003eThe attacker could select any workflow module to execute, including action modules that write blocklist and warninglist entries, and supply arbitrary input and parameters of their choosing. This constitutes a cross-site request forgery (CSRF) vulnerability with high integrity impact on the MISP instance\u0027s security-related data.\u0026nbsp;\u003c/p\u003e\u003cp\u003eThe vulnerability was identified during an internal security review and was not externally reported. The fix is included in MISP v2.5.47.\u003c/p\u003e"
}
],
"value": "MISP\u0027s WorkflowsController exposed the moduleStatelessExecution action in the Security component\u0027s unlockedActions list. In CakePHP, listing an action in unlockedActions disables both the CSRF token check and the field hash validation for that action. Because moduleStatelessExecution executes a workflow module\u0027s exec() method with caller-supplied input and parameters, the absence of CSRF protection allowed an attacker to craft a cross-site form post (or equivalent cross-origin request) that, when submitted by an authenticated site administrator, would cause the administrator\u0027s browser to invoke the action on the MISP instance.\u00a0\n\nThe attacker could select any workflow module to execute, including action modules that write blocklist and warninglist entries, and supply arbitrary input and parameters of their choosing. This constitutes a cross-site request forgery (CSRF) vulnerability with high integrity impact on the MISP instance\u0027s security-related data.\u00a0\n\nThe vulnerability was identified during an internal security review and was not externally reported. The fix is included in MISP v2.5.47."
}
],
"impacts": [
{
"capecId": "CAPEC-124",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-124 Cross-Site Request Forgery"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "CWE-352 Cross-Site Request Forgery (CSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"orgId": "00000000-0000-4000-9000-000000000000"
},
"references": [
{
"name": "Security patch",
"tags": [
"patch"
],
"url": "https://github.com/MISP/MISP/commit/f05e0d1c2"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe moduleStatelessExecution action is removed from the unlockedActions list, restoring the CSRF token check. A new mechanism (_csrfTokenHeaderOnly) is introduced that enforces the CSRF token while exempting only the field hash, which the legitimate caller (the module dialog) cannot produce because it posts a hand-built object. The module dialog\u0027s AJAX request is updated to send the CSRF token in the X-CSRF-Token header, satisfying the token check without requiring a field hash.\u003c/p\u003e"
}
],
"value": "The moduleStatelessExecution action is removed from the unlockedActions list, restoring the CSRF token check. A new mechanism (_csrfTokenHeaderOnly) is introduced that enforces the CSRF token while exempting only the field hash, which the legitimate caller (the module dialog) cannot produce because it posts a hand-built object. The module dialog\u0027s AJAX request is updated to send the CSRF token in the X-CSRF-Token header, satisfying the token check without requiring a field hash."
}
],
"title": "MISP CSRF vulnerability in workflow moduleStatelessExecution allows cross-site execution of workflow modules",
"x_gcve": [
{
"extensions": {
"bcp-05-x-01": {
"ai_annotations": [
{
"ai_level": "generated",
"description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
"gna_source": 1,
"models": [
{
"gna_source": 1,
"identifier": "qwen3.8:27b",
"name": "qwen3.8:27b",
"source": "ollama"
}
],
"review_status": "full",
"scope": "record",
"tags": [
"ai-computer-assisted:llm-generated",
"ai-computer-assisted:classification"
]
}
]
},
"bcp-05-x-02": {
"x_patch2vuln": {
"assumptions": [
"The affected version range is inferred from the tag_version_boundary metadata (v2.5.47, 6 commits after fix), implying the fix is included in v2.5.47 and prior versions are affected. The exact introduction version of the vulnerable code is unknown.",
"UI:A is used because the CSRF attack requires the victim to actively navigate to the attacker\u0027s page or click a link; a purely passive load (e.g., embedded iframe auto-submit) would map to UI:P, but the commit message describes a \u0027cross-site form post\u0027 which typically requires at least a page visit.",
"SI:N is chosen because the evidence only demonstrates integrity impact on MISP\u0027s own blocklist and warninglist data; no evidence supports impact on downstream or external systems.",
"The CAPEC-124 mapping is confident based on the explicit description of a cross-site form post in the commit message.",
"The commit message states the issue was \u0027found during the internal review, not externally reported,\u0027 but does not explicitly name a finder; therefore no finder credit is assigned.",
"The _csrfTokenHeaderOnly method is referenced in the patch but its implementation is not shown; it is assumed to enforce CSRF token validation while exempting the field hash, as described in the commit message."
],
"capecRationale": [
{
"capecId": "CAPEC-124",
"rationale": "The attack pattern described in the commit message is a cross-site form post that causes an authenticated site admin to execute a workflow module with attacker-chosen parameters. This maps directly to CAPEC-124, which describes an attacker exploiting the trust a web application places in a user\u0027s browser session to perform unauthorized actions. The mapping is confident because the commit message explicitly describes a cross-site form post bypassing CSRF protection."
}
],
"commit": "f05e0d1c263b211108644fe6f1600ad7fde9b915",
"confidence": "high",
"credits": [
{
"lang": "en",
"type": "remediation developer",
"value": "iglocska"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Claude Opus 5 (1M context)"
}
],
"cvssRationale": "AV:N: The attack is delivered over the network via a malicious web page. AC:L: Crafting a cross-site form post is straightforward. AT:N: No special conditions or timing are required. PR:N: The attacker requires no account or privileges on the MISP instance. UI:A: The victim (a site admin) must actively visit the attacker-controlled page or click a link that triggers the form submission. VC:N: No confidentiality impact is evident. VI:H: The attacker can write arbitrary blocklist and warninglist entries, significantly compromising the integrity of MISP\u0027s security data. VA:N: No availability impact. SC/SI/SA:N: No evidence of impact on other systems beyond MISP itself.",
"fixSummary": "The moduleStatelessExecution action is removed from the unlockedActions list, restoring the CSRF token check. A new mechanism (_csrfTokenHeaderOnly) is introduced that enforces the CSRF token while exempting only the field hash, which the legitimate caller (the module dialog) cannot produce because it posts a hand-built object. The module dialog\u0027s AJAX request is updated to send the CSRF token in the X-CSRF-Token header, satisfying the token check without requiring a field hash.",
"generatedAt": "2026-09-22T12:15:58.553959Z",
"generator": "patch2vuln.py",
"model": "qwen3.8:27b",
"modelComparison": {
"rankings": [
{
"agreementScore": 9,
"assumptionCount": 6,
"confidence": "high",
"model": "qwen3.8:27b",
"score": 5
}
],
"selectedModel": "qwen3.8:27b",
"selectionMethod": "deterministic-consensus-v1",
"selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
},
"patchSha256": "3f8a00ca29761ed6a3986633e60ec67a964e3bfc1dc1e2631a2c2d80df827d30",
"patchSummary": "In WorkflowsController::beforeFilter(), the line adding \u0027moduleStatelessExecution\u0027 to $this-\u003eSecurity-\u003eunlockedActions is replaced with a call to $this-\u003e_csrfTokenHeaderOnly([\u0027moduleStatelessExecution\u0027]), which enforces CSRF token validation while waiving only the field hash requirement. In execute_module.ctp, the jQuery $.ajax() call is modified to include the header \u0027X-CSRF-Token\u0027 populated from window.csrfToken, so the legitimate client-side caller passes the token check via the header rather than a form field.",
"patchTruncated": false,
"patches": [
{
"commit": "f05e0d1c263b211108644fe6f1600ad7fde9b915",
"patchSha256": "3f8a00ca29761ed6a3986633e60ec67a964e3bfc1dc1e2631a2c2d80df827d30",
"source": "https://github.com/MISP/MISP/commit/f05e0d1c2.patch",
"sourceUrl": "https://github.com/MISP/MISP/commit/f05e0d1c2.patch",
"subject": "fix: [security] Keep the CSRF check on stateless workflow"
}
],
"source": "https://github.com/MISP/MISP/commit/f05e0d1c2.patch",
"subject": "fix: [security] Keep the CSRF check on stateless workflow",
"tagVersionBoundary": {
"commits_after_fix": 6,
"repository": "https://github.com/MISP/MISP",
"tag": "v2.5.47",
"version": "2.5.47",
"version_type": "semver"
},
"weaknessRationale": [
{
"cweId": "CWE-352",
"rationale": "The vulnerable action was placed in unlockedActions, which disabled the CSRF token check. This allowed a cross-site form post to trigger a state-changing action (workflow module execution) on behalf of an authenticated administrator, which is the textbook definition of CSRF."
}
]
}
}
},
"recordType": "advisory",
"vulnId": "GCVE-1-2026-20261"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "00000000-0000-4000-9000-000000000000",
"cveId": "CVE-2026-95658",
"datePublished": "2026-09-22T12:31:11.850218Z",
"dateReserved": "2026-09-22T12:31:20.344Z",
"dateUpdated": "2026-09-22T12:31:20.402691Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1-2026-20261"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
GCVE-1-2026-20242 (CVE-2026-91857)
Vulnerability from gna-1 – Published: 2026-09-15 09:14 – Updated: 2026-09-15 09:14
VLAI
EPSS
VEX
Title
MISP: State-changing actions accessible via GET request enabling CSRF
Summary
Affected versions of MISP expose several state-changing controller actions without restricting them to POST.
The affected actions are:
- EventReportsController::purgeUnusedPictures()
- NoticelistsController::enableNoticelist()
- ServersController::removeOrphanedCorrelations()
- WorkflowsController::rebuildRedis()
The patch adds allowMethod(['post']) to each action, preventing them from being triggered through ordinary GET requests.
For purgeUnusedPictures(), the corresponding UI previously used $.get(). The fix converts that request to POST and supplies X-CSRF-Token, while the controller enables header-only CSRF validation for that AJAX action.
Because GET requests can be induced cross-origin through links, images, redirects, or navigation, accepting GET for these state-changing operations can let an attacker trigger them using the authenticated victim's session.
Version affected: ≤2.5.45
Severity
CWE
- CWE-352 - Cross-Site Request Forgery (CSRF)
Assigner
GNA-1
This instance
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/MISP/MISP/commit/b4a5486b5 | patch |
GCVE extensions
AI-generated
Confidence: high
Model
qwen3.8:27b
advisory
bcp-05-x-01bcp-05-x-02
AI involvement
GCVE-BCP-05-X-01
Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.
ai-computer-assisted:llm-generatedai-computer-assisted:classification
| Model | Source | Identifier |
|---|---|---|
| qwen3.8:27b | ollama | qwen3.8:27b |
Patch provenance
GCVE-BCP-05-X-02
- Generator
-
patch2vuln.pyon 2026-09-15 09:10 - Model
qwen3.8:27b- Input
-
https://github.com/MISP/MISP/commit/b4a5486b5.patch
adc31514b96a… - Confidence
- high
| Commit | Subject | Patch SHA-256 |
|---|---|---|
b4a5486b5ddd
|
fix: [security] Require POST for four remaining | adc31514b96a… |
Fix summary
The vulnerability is remediated by restricting all four state-changing actions to accept only POST requests via the CakePHP allowMethod() guard. Additionally, the client-side JavaScript for purgeUnusedPictures is updated to issue a POST request with the page's CSRF token in the X-CSRF-Token header, and a beforeFilter() hook is added to EventReportsController to configure header-only CSRF token validation for that specific action, since it is invoked via hand-built AJAX rather than a rendered form.
Patch summary
Adds $this->request->allowMethod(['post']) to purgeUnusedPictures, enableNoticelist, removeOrphanedCorrelations, and rebuildRedis. Adds a beforeFilter() method to EventReportsController calling _csrfTokenHeaderOnly(['purgeUnusedPictures']) to permit CSRF token validation via the X-CSRF-Token header. Updates the managed_imported_pictures.ctp view to replace $.get() with $.ajax() using type 'post' and the X-CSRF-Token header. Adds REST response handling and flash/redirect logic to rebuildRedis for consistency with other actions.
CVSS rationale
AV:N: The attack is delivered over the network (e.g., a malicious link or page). AC:L: No special race conditions or complex setup are required; a simple GET URL suffices. AT:N: No prior compromise or manipulation of the target system is needed. PR:L: The attacker requires the victim to be an authenticated MISP user; the attacker themselves need not be authenticated. UI:A: The victim must actively interact (click a link or navigate to a crafted page) to trigger the forged request. VC:N: No confidential data is exposed by the affected actions. VI:L: Integrity impact is low; the actions cause limited state changes (deleting unused pictures, toggling a noticelist, removing orphaned correlations, rebuilding a cache) rather than corrupting critical data. VA:N: No meaningful availability impact; the actions do not cause denial of service. SC/SI/SA:N: No impact on subsequent systems.
Weakness rationale
- CWE-352 The root cause is that state-changing endpoints accept GET requests, which are not protected by the framework's CSRF token mechanism. This allows an attacker to forge requests on behalf of an authenticated user via links, auto-loading resources, or other passive/active user interactions, which is the defining characteristic of CSRF.
Assumptions to verify
- The fix commit is 196 commits before the v2.5.46 tag, implying the vulnerability existed in versions prior to v2.5.46; exact affected version range is not explicitly stated in the patch.
- MISP requires user authentication to access the affected endpoints; the PR:L assumption is based on MISP's standard authentication model.
- The CSRF token mechanism in CakePHP (the framework used by MISP) is assumed to protect POST requests but not GET requests, consistent with the patch's own comments.
- The vulnerability was found during internal review and was not externally reported, per the commit message.
Model comparison
Selected qwen3.8:27b
by deterministic-consensus-v1
The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required.
| Model | Score | Agreement | Confidence | Assumptions |
|---|---|---|---|---|
qwen3.8:27b |
7 | 9 | high | 4 |
{
"containers": {
"cna": {
"affected": [
{
"modules": [
"EventReportsController",
"NoticelistsController",
"ServersController",
"WorkflowsController"
],
"product": "MISP",
"programFiles": [
"app/Controller/EventReportsController.php",
"app/Controller/NoticelistsController.php",
"app/Controller/ServersController.php",
"app/Controller/WorkflowsController.php",
"app/View/EventReports/managed_imported_pictures.ctp"
],
"repo": "https://github.com/MISP/MISP",
"vendor": "MISP",
"versions": [
{
"lessThan": "2.5.46",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "remediation developer",
"value": "iglocska"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Claude Opus 5 (1M context)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003c/p\u003e\u003cp\u003eAffected versions of MISP expose several state-changing controller actions without restricting them to POST.\u003c/p\u003e\n\u003cp\u003eThe affected actions are:\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003ccode\u003e\u2003-\u0026nbsp;EventReportsController::purgeUnusedPictures()\u003c/code\u003e\n\u003cbr\u003e\u003ccode\u003e\u2003-\u0026nbsp;NoticelistsController::enableNoticelist()\u003c/code\u003e\n\u003cbr\u003e\u003ccode\u003e\u2003-\u0026nbsp;ServersController::removeOrphanedCorrelations()\u003c/code\u003e\n\u003cbr\u003e\u003cdiv\u003e\u003ccode\u003e\u2003- WorkflowsController::rebuildRedis()\u003c/code\u003e\u003c/div\u003e\u003cdiv\u003e\u003ccode\u003e\u003cbr\u003e\u003c/code\u003e\u003c/div\u003e\u003cp\u003e\u003ccode\u003e\u003c/code\u003e\u003c/p\u003e\u003cp\u003eThe patch adds \u003ccode\u003eallowMethod([\u0027post\u0027])\u003c/code\u003e to each action, preventing them from being triggered through ordinary GET requests.\u003c/p\u003e\n\u003cp\u003eFor \u003ccode\u003epurgeUnusedPictures()\u003c/code\u003e, the corresponding UI previously used \u003ccode\u003e$.get()\u003c/code\u003e. The fix converts that request to POST and supplies \u003ccode\u003eX-CSRF-Token\u003c/code\u003e, while the controller enables header-only CSRF validation for that AJAX action.\u003c/p\u003e\n\u003cp\u003eBecause GET requests can be induced cross-origin through links, images, redirects, or navigation, accepting GET for these state-changing operations can let an attacker trigger them using the authenticated victim\u0027s session.\u003c/p\u003e\u003cp\u003eVersion affected: \u22642.5.45\u003cbr\u003e\u003c/p\u003e\u003cp\u003e\u003c/p\u003e"
}
],
"value": "Affected versions of MISP expose several state-changing controller actions without restricting them to POST.\n\n\nThe affected actions are:\n\n\n\n\u2003-\u00a0EventReportsController::purgeUnusedPictures()\n\n\u2003-\u00a0NoticelistsController::enableNoticelist()\n\n\u2003-\u00a0ServersController::removeOrphanedCorrelations()\n\n\u2003- WorkflowsController::rebuildRedis()\n\n\n\n\n\n\nThe patch adds allowMethod([\u0027post\u0027]) to each action, preventing them from being triggered through ordinary GET requests.\n\n\nFor purgeUnusedPictures(), the corresponding UI previously used $.get(). The fix converts that request to POST and supplies X-CSRF-Token, while the controller enables header-only CSRF validation for that AJAX action.\n\n\nBecause GET requests can be induced cross-origin through links, images, redirects, or navigation, accepting GET for these state-changing operations can let an attacker trigger them using the authenticated victim\u0027s session.\n\nVersion affected: \u22642.5.45"
}
],
"impacts": [
{
"capecId": "CAPEC-62",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-62 Cross Site Request Forgery"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "CWE-352 Cross-Site Request Forgery (CSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"orgId": "00000000-0000-4000-9000-000000000000"
},
"references": [
{
"name": "Security patch",
"tags": [
"patch"
],
"url": "https://github.com/MISP/MISP/commit/b4a5486b5"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe vulnerability is remediated by restricting all four state-changing actions to accept only POST requests via the CakePHP allowMethod() guard. Additionally, the client-side JavaScript for purgeUnusedPictures is updated to issue a POST request with the page\u0027s CSRF token in the X-CSRF-Token header, and a beforeFilter() hook is added to EventReportsController to configure header-only CSRF token validation for that specific action, since it is invoked via hand-built AJAX rather than a rendered form.\u003c/p\u003e"
}
],
"value": "The vulnerability is remediated by restricting all four state-changing actions to accept only POST requests via the CakePHP allowMethod() guard. Additionally, the client-side JavaScript for purgeUnusedPictures is updated to issue a POST request with the page\u0027s CSRF token in the X-CSRF-Token header, and a beforeFilter() hook is added to EventReportsController to configure header-only CSRF token validation for that specific action, since it is invoked via hand-built AJAX rather than a rendered form."
}
],
"title": "MISP: State-changing actions accessible via GET request enabling CSRF",
"x_gcve": [
{
"extensions": {
"bcp-05-x-01": {
"ai_annotations": [
{
"ai_level": "generated",
"description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
"gna_source": 1,
"models": [
{
"gna_source": 1,
"identifier": "qwen3.8:27b",
"name": "qwen3.8:27b",
"source": "ollama"
}
],
"review_status": "review",
"scope": "record",
"tags": [
"ai-computer-assisted:llm-generated",
"ai-computer-assisted:classification"
]
}
]
},
"bcp-05-x-02": {
"x_patch2vuln": {
"assumptions": [
"The fix commit is 196 commits before the v2.5.46 tag, implying the vulnerability existed in versions prior to v2.5.46; exact affected version range is not explicitly stated in the patch.",
"MISP requires user authentication to access the affected endpoints; the PR:L assumption is based on MISP\u0027s standard authentication model.",
"The CSRF token mechanism in CakePHP (the framework used by MISP) is assumed to protect POST requests but not GET requests, consistent with the patch\u0027s own comments.",
"The vulnerability was found during internal review and was not externally reported, per the commit message."
],
"commit": "b4a5486b5ddd078dc11248cbd7f21725fb1f43cf",
"confidence": "high",
"credits": [
{
"lang": "en",
"type": "remediation developer",
"value": "iglocska"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Claude Opus 5 (1M context)"
}
],
"cvssRationale": "AV:N: The attack is delivered over the network (e.g., a malicious link or page). AC:L: No special race conditions or complex setup are required; a simple GET URL suffices. AT:N: No prior compromise or manipulation of the target system is needed. PR:L: The attacker requires the victim to be an authenticated MISP user; the attacker themselves need not be authenticated. UI:A: The victim must actively interact (click a link or navigate to a crafted page) to trigger the forged request. VC:N: No confidential data is exposed by the affected actions. VI:L: Integrity impact is low; the actions cause limited state changes (deleting unused pictures, toggling a noticelist, removing orphaned correlations, rebuilding a cache) rather than corrupting critical data. VA:N: No meaningful availability impact; the actions do not cause denial of service. SC/SI/SA:N: No impact on subsequent systems.",
"draft": false,
"fixSummary": "The vulnerability is remediated by restricting all four state-changing actions to accept only POST requests via the CakePHP allowMethod() guard. Additionally, the client-side JavaScript for purgeUnusedPictures is updated to issue a POST request with the page\u0027s CSRF token in the X-CSRF-Token header, and a beforeFilter() hook is added to EventReportsController to configure header-only CSRF token validation for that specific action, since it is invoked via hand-built AJAX rather than a rendered form.",
"generatedAt": "2026-09-15T09:10:36.581856Z",
"generator": "patch2vuln.py",
"model": "qwen3.8:27b",
"modelComparison": {
"rankings": [
{
"agreementScore": 9,
"assumptionCount": 4,
"confidence": "high",
"model": "qwen3.8:27b",
"score": 7
}
],
"selectedModel": "qwen3.8:27b",
"selectionMethod": "deterministic-consensus-v1",
"selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
},
"patchSha256": "adc31514b96a99a411ca1ed5a31abf99642d19de3a09f536e62310b298d2552b",
"patchSummary": "Adds $this-\u003erequest-\u003eallowMethod([\u0027post\u0027]) to purgeUnusedPictures, enableNoticelist, removeOrphanedCorrelations, and rebuildRedis. Adds a beforeFilter() method to EventReportsController calling _csrfTokenHeaderOnly([\u0027purgeUnusedPictures\u0027]) to permit CSRF token validation via the X-CSRF-Token header. Updates the managed_imported_pictures.ctp view to replace $.get() with $.ajax() using type \u0027post\u0027 and the X-CSRF-Token header. Adds REST response handling and flash/redirect logic to rebuildRedis for consistency with other actions.",
"patchTruncated": false,
"patches": [
{
"commit": "b4a5486b5ddd078dc11248cbd7f21725fb1f43cf",
"patchSha256": "adc31514b96a99a411ca1ed5a31abf99642d19de3a09f536e62310b298d2552b",
"source": "https://github.com/MISP/MISP/commit/b4a5486b5.patch",
"sourceUrl": "https://github.com/MISP/MISP/commit/b4a5486b5.patch",
"subject": "fix: [security] Require POST for four remaining"
}
],
"source": "https://github.com/MISP/MISP/commit/b4a5486b5.patch",
"subject": "fix: [security] Require POST for four remaining",
"tagVersionBoundary": {
"commits_after_fix": 196,
"repository": "https://github.com/MISP/MISP",
"tag": "v2.5.46",
"version": "2.5.46",
"version_type": "semver"
},
"weaknessRationale": [
{
"cweId": "CWE-352",
"rationale": "The root cause is that state-changing endpoints accept GET requests, which are not protected by the framework\u0027s CSRF token mechanism. This allows an attacker to forge requests on behalf of an authenticated user via links, auto-loading resources, or other passive/active user interactions, which is the defining characteristic of CSRF."
}
]
}
}
},
"recordType": "advisory",
"vulnId": "GCVE-1-2026-20242"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "00000000-0000-4000-9000-000000000000",
"cveId": "CVE-2026-91857",
"datePublished": "2026-09-15T09:14:33.110236Z",
"dateReserved": "2026-09-15T09:14:39.778Z",
"dateUpdated": "2026-09-15T09:14:40.600582Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1-2026-20242"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
GCVE-1-2026-20235 (CVE-2026-85546)
Vulnerability from gna-1 – Published: 2026-09-04 09:27 – Updated: 2026-09-10 07:44
VLAI
EPSS
VEX
Title
MISP Sharing Group Quick-Edit Actions Allow CSRF via State-Changing GET Requests
Summary
MISP contains a cross-site request forgery (CSRF) vulnerability in the sharing group quick-edit functionality. The addOrg, removeOrg, addServer, and removeServer actions share the __initialiseSGQuickEdit() helper, where the HTTP method validation intended to restrict these operations to POST requests was commented out.
As a result, these state-changing actions could be invoked using GET requests. An attacker could craft a URL targeting one of the affected actions and cause an authenticated MISP user with sufficient privileges to request it, for example through a malicious link or embedded web resource.
Successful exploitation could modify the membership of a MISP sharing group without the victim intentionally performing the operation. Depending on the action performed, an attacker could add or remove organisations or servers from a sharing group, potentially granting unintended access to information distributed through that sharing group or disrupting legitimate information sharing.
The patch restores HTTP method enforcement centrally in __initialiseSGQuickEdit() by calling allowMethod(['post']), ensuring that all four affected quick-edit operations require POST requests and are therefore subject to the application's normal protections for state-changing requests.
Severity
CWE
- CWE-352 - Cross-Site Request Forgery (CSRF)
Assigner
GNA-1
This instance
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/MISP/MISP/commit/3060d93cb | patch |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "misp",
"repo": "https://github.com/MISP/MISP",
"vendor": "misp",
"versions": [
{
"lessThanOrEqual": "2.4.45",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "remediation developer",
"value": "Andras Iklody"
},
{
"lang": "en",
"type": "finder",
"value": "Scottish Government - National Cyber Team"
},
{
"lang": "en",
"type": "finder",
"value": "Peter James"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eMISP contains a cross-site request forgery (CSRF) vulnerability in the sharing group quick-edit functionality. The \u003ccode\u003eaddOrg\u003c/code\u003e, \u003ccode\u003eremoveOrg\u003c/code\u003e, \u003ccode\u003eaddServer\u003c/code\u003e, and \u003ccode\u003eremoveServer\u003c/code\u003e actions share the \u003ccode\u003e__initialiseSGQuickEdit()\u003c/code\u003e helper, where the HTTP method validation intended to restrict these operations to POST requests was commented out.\u003c/p\u003e\u003cp\u003eAs a result, these state-changing actions could be invoked using GET requests. An attacker could craft a URL targeting one of the affected actions and cause an authenticated MISP user with sufficient privileges to request it, for example through a malicious link or embedded web resource.\u003c/p\u003e\u003cp\u003eSuccessful exploitation could modify the membership of a MISP sharing group without the victim intentionally performing the operation. Depending on the action performed, an attacker could add or remove organisations or servers from a sharing group, potentially granting unintended access to information distributed through that sharing group or disrupting legitimate information sharing.\u003c/p\u003e\u003cp\u003eThe patch restores HTTP method enforcement centrally in \u003ccode\u003e__initialiseSGQuickEdit()\u003c/code\u003e by calling \u003ccode\u003eallowMethod([\u0027post\u0027])\u003c/code\u003e, ensuring that all four affected quick-edit operations require POST requests and are therefore subject to the application\u0027s normal protections for state-changing requests.\u003c/p\u003e\u003cbr\u003e"
}
],
"value": "MISP contains a cross-site request forgery (CSRF) vulnerability in the sharing group quick-edit functionality. The addOrg, removeOrg, addServer, and removeServer actions share the __initialiseSGQuickEdit() helper, where the HTTP method validation intended to restrict these operations to POST requests was commented out.\n\nAs a result, these state-changing actions could be invoked using GET requests. An attacker could craft a URL targeting one of the affected actions and cause an authenticated MISP user with sufficient privileges to request it, for example through a malicious link or embedded web resource.\n\nSuccessful exploitation could modify the membership of a MISP sharing group without the victim intentionally performing the operation. Depending on the action performed, an attacker could add or remove organisations or servers from a sharing group, potentially granting unintended access to information distributed through that sharing group or disrupting legitimate information sharing.\n\nThe patch restores HTTP method enforcement centrally in __initialiseSGQuickEdit() by calling allowMethod([\u0027post\u0027]), ensuring that all four affected quick-edit operations require POST requests and are therefore subject to the application\u0027s normal protections for state-changing requests."
}
],
"impacts": [
{
"capecId": "CAPEC-62",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-62 Cross Site Request Forgery"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "CWE-352 Cross-Site Request Forgery (CSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"orgId": "00000000-0000-4000-9000-000000000000"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/MISP/MISP/commit/3060d93cb"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "MISP Sharing Group Quick-Edit Actions Allow CSRF via State-Changing GET Requests",
"x_gcve": [
{
"recordType": "advisory",
"vulnId": "gcve-1-2026-20235"
}
],
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "00000000-0000-4000-9000-000000000000",
"cveId": "CVE-2026-85546",
"datePublished": "2026-09-04T09:27:00.000Z",
"dateReserved": "2026-09-04T09:27:00.000Z",
"dateUpdated": "2026-09-10T07:44:51.336437Z",
"requesterUserId": "00000000-0000-4000-9000-000000000000",
"serial": 1,
"state": "PUBLISHED",
"vulnId": "gcve-1-2026-20235"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
GCVE-1-2026-20226 (CVE-2026-90893)
Vulnerability from gna-1 – Published: 2026-09-14 09:11 – Updated: 2026-09-14 09:12
VLAI
EPSS
VEX
Title
MISP UserSettingsController CSRF Protection Bypass on setTheme, setHomePage, and eventIndexColumnToggle Endpoints
Summary
MISP contains a Cross-Site Request Forgery (CSRF) vulnerability in the UserSettingsController. The actions setTheme, setHomePage, and eventIndexColumnToggle were explicitly added to the Security component's unlockedActions list, which disabled all CSRF validation (both token and field-hash checks) for those endpoints. Because these endpoints accept POST requests and modify per-user application state (theme selection, default homepage URL, and event index column visibility), an attacker who can induce a logged-in MISP user to load a malicious page (e.g., via a crafted link, embedded image, or auto-submitting form) can forge requests that alter the victim's settings without their knowledge or consent. The most impactful action is setHomePage, which allows an attacker to redirect the victim's default landing page to an arbitrary attacker-controlled URL, potentially facilitating phishing or further social engineering. The setTheme action can alter the user's visual theme, and eventIndexColumnToggle can change which columns are displayed in the event index view. No authentication bypass is involved; the victim must already be authenticated to MISP. The vulnerability was reported by the Scottish Government National Cyber Team.
Version affected: ≤2.5.45
Severity
CWE
- CWE-352 - Cross-Site Request Forgery (CSRF)
Assigner
GNA-1
This instance
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/MISP/MISP/commit/979337b18 | patch |
GCVE extensions
AI-generated
Confidence: medium
Model
qwen3.8:27b
advisory
bcp-05-x-01bcp-05-x-02
AI involvement
GCVE-BCP-05-X-01
Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.
ai-computer-assisted:llm-generatedai-computer-assisted:classification
| Model | Source | Identifier |
|---|---|---|
| qwen3.8:27b | ollama | qwen3.8:27b |
Patch provenance
GCVE-BCP-05-X-02
- Generator
-
patch2vuln.pyon 2026-09-14 08:59 - Model
qwen3.8:27b- Input
-
https://github.com/MISP/MISP/commit/979337b18.patch
287bea96c3ef… - Confidence
- medium
| Commit | Subject | Patch SHA-256 |
|---|---|---|
979337b182ae
|
fix: [security] Put the user-settings endpoints back under | 287bea96c3ef… |
Fix summary
The fix removes the three affected actions from the Security component's unlockedActions list (which had disabled all CSRF checks) and instead registers them under a header-only CSRF token validation mechanism (_csrfTokenHeaderOnly). This requires the X-CSRF-Token header to be present and valid on each request while still permitting the AJAX-style calls that lack traditional form fields. Client-side JavaScript and view templates are updated to include the X-CSRF-Token header (sourced from window.csrfToken) in all AJAX and fetch calls to these endpoints, ensuring legitimate same-origin requests continue to function while cross-origin forged requests are rejected.
Patch summary
In UserSettingsController::beforeFilter(), the three lines adding eventIndexColumnToggle, setTheme, and setHomePage to $this->Security->unlockedActions[] are removed and replaced with a single $this->_csrfTokenHeaderOnly() call covering all four affected actions (including setEventTemplateUserFormMode). In global_menu.ctp (default and UiBeta themes), navbar.ctp (Overmind theme), and misp.js, the jQuery $.ajax() and fetch() calls that invoke setTheme, setHomePage, and eventIndexColumnToggle are updated to include an X-CSRF-Token header populated from window.csrfToken. The Overmind navbar fetch calls also gain credentials: 'same-origin' to ensure cookies are sent with the request.
CVSS rationale
AV:N: The attack is delivered over the network via a malicious web page. AC:L: CSRF exploitation is straightforward with no race conditions or special timing. AT:N: No special target state is required beyond normal authentication. PR:N: The attacker requires no privileges on the MISP instance. UI:P: The victim must passively load the attacker's page while authenticated (e.g., click a link or visit a site). VC:N: No confidential data is exposed. VI:L: User-controlled settings (theme, homepage, column visibility) are modified, representing a low integrity impact. VA:N: No availability impact. SC/SI/SA:N: No impact on adjacent or downstream systems.
Weakness rationale
- CWE-352 The endpoints were explicitly excluded from CSRF validation via the Security component's unlockedActions mechanism, allowing a cross-origin page to submit state-changing POST requests on behalf of an authenticated user without a valid CSRF token.
Assumptions to verify
- The MISP instance is assumed to be deployed in a standard configuration where the Security component's CSRF protection is enabled by default; if an operator had globally disabled CSRF checks, this specific vulnerability would be subsumed by that broader misconfiguration.
- The setHomePage endpoint is assumed to accept an arbitrary URL path as its argument based on the patch comment stating 'a single path the user picks anyway and which setSetting() validates server-side'; the exact validation logic was not visible in the patch.
- Exact affected version range could not be determined from the patch alone; the fix commit is 225 commits after the v2.5.46 tag, suggesting the vulnerability existed in releases around and after v2.5.46, but precise boundaries are unspecified.
- CVSS UI:P assumes the victim must load an attacker-controlled page; if MISP is deployed behind a strict CSP that blocks cross-origin form submission, exploitability may be reduced, but this is not confirmed by the patch.
Model comparison
Selected qwen3.8:27b
by deterministic-consensus-v1
The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required.
| Model | Score | Agreement | Confidence | Assumptions |
|---|---|---|---|---|
qwen3.8:27b |
6 | 9 | medium | 4 |
{
"containers": {
"cna": {
"affected": [
{
"modules": [
"UserSettingsController",
"app/Controller/UserSettingsController.php"
],
"product": "MISP",
"programFiles": [
"app/Controller/UserSettingsController.php",
"app/View/Elements/global_menu.ctp",
"app/View/Themed/Overmind/Elements/navbar.ctp",
"app/View/Themed/UiBeta/Elements/global_menu.ctp",
"app/webroot/js/misp.js"
],
"repo": "https://github.com/MISP/MISP",
"vendor": "MISP",
"versions": [
{
"lessThan": "2.5.46",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Scottish Government - National Cyber Team"
},
{
"lang": "en",
"type": "remediation developer",
"value": "iglocska"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Claude Opus 5 (1M context)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eMISP contains a Cross-Site Request Forgery (CSRF) vulnerability in the UserSettingsController. The actions setTheme, setHomePage, and eventIndexColumnToggle were explicitly added to the Security component\u0027s unlockedActions list, which disabled all CSRF validation (both token and field-hash checks) for those endpoints. Because these endpoints accept POST requests and modify per-user application state (theme selection, default homepage URL, and event index column visibility), an attacker who can induce a logged-in MISP user to load a malicious page (e.g., via a crafted link, embedded image, or auto-submitting form) can forge requests that alter the victim\u0027s settings without their knowledge or consent. The most impactful action is setHomePage, which allows an attacker to redirect the victim\u0027s default landing page to an arbitrary attacker-controlled URL, potentially facilitating phishing or further social engineering. The setTheme action can alter the user\u0027s visual theme, and eventIndexColumnToggle can change which columns are displayed in the event index view. No authentication bypass is involved; the victim must already be authenticated to MISP. The vulnerability was reported by the Scottish Government National Cyber Team.\u003c/p\u003e\u003cp\u003eVersion affected: \u22642.5.45\u003cbr\u003e\u003c/p\u003e"
}
],
"value": "MISP contains a Cross-Site Request Forgery (CSRF) vulnerability in the UserSettingsController. The actions setTheme, setHomePage, and eventIndexColumnToggle were explicitly added to the Security component\u0027s unlockedActions list, which disabled all CSRF validation (both token and field-hash checks) for those endpoints. Because these endpoints accept POST requests and modify per-user application state (theme selection, default homepage URL, and event index column visibility), an attacker who can induce a logged-in MISP user to load a malicious page (e.g., via a crafted link, embedded image, or auto-submitting form) can forge requests that alter the victim\u0027s settings without their knowledge or consent. The most impactful action is setHomePage, which allows an attacker to redirect the victim\u0027s default landing page to an arbitrary attacker-controlled URL, potentially facilitating phishing or further social engineering. The setTheme action can alter the user\u0027s visual theme, and eventIndexColumnToggle can change which columns are displayed in the event index view. No authentication bypass is involved; the victim must already be authenticated to MISP. The vulnerability was reported by the Scottish Government National Cyber Team.\n\nVersion affected: \u22642.5.45"
}
],
"impacts": [
{
"capecId": "CAPEC-62",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-62 Cross Site Request Forgery"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "CWE-352 Cross-Site Request Forgery (CSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"orgId": "00000000-0000-4000-9000-000000000000"
},
"references": [
{
"name": "Security patch",
"tags": [
"patch"
],
"url": "https://github.com/MISP/MISP/commit/979337b18"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe fix removes the three affected actions from the Security component\u0027s unlockedActions list (which had disabled all CSRF checks) and instead registers them under a header-only CSRF token validation mechanism (_csrfTokenHeaderOnly). This requires the X-CSRF-Token header to be present and valid on each request while still permitting the AJAX-style calls that lack traditional form fields. Client-side JavaScript and view templates are updated to include the X-CSRF-Token header (sourced from window.csrfToken) in all AJAX and fetch calls to these endpoints, ensuring legitimate same-origin requests continue to function while cross-origin forged requests are rejected.\u003c/p\u003e"
}
],
"value": "The fix removes the three affected actions from the Security component\u0027s unlockedActions list (which had disabled all CSRF checks) and instead registers them under a header-only CSRF token validation mechanism (_csrfTokenHeaderOnly). This requires the X-CSRF-Token header to be present and valid on each request while still permitting the AJAX-style calls that lack traditional form fields. Client-side JavaScript and view templates are updated to include the X-CSRF-Token header (sourced from window.csrfToken) in all AJAX and fetch calls to these endpoints, ensuring legitimate same-origin requests continue to function while cross-origin forged requests are rejected."
}
],
"title": "MISP UserSettingsController CSRF Protection Bypass on setTheme, setHomePage, and eventIndexColumnToggle Endpoints",
"x_gcve": [
{
"extensions": {
"bcp-05-x-01": {
"ai_annotations": [
{
"ai_level": "generated",
"description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
"gna_source": 1,
"models": [
{
"gna_source": 1,
"identifier": "qwen3.8:27b",
"name": "qwen3.8:27b",
"source": "ollama"
}
],
"review_status": "review",
"scope": "record",
"tags": [
"ai-computer-assisted:llm-generated",
"ai-computer-assisted:classification"
]
}
]
},
"bcp-05-x-02": {
"x_patch2vuln": {
"assumptions": [
"The MISP instance is assumed to be deployed in a standard configuration where the Security component\u0027s CSRF protection is enabled by default; if an operator had globally disabled CSRF checks, this specific vulnerability would be subsumed by that broader misconfiguration.",
"The setHomePage endpoint is assumed to accept an arbitrary URL path as its argument based on the patch comment stating \u0027a single path the user picks anyway and which setSetting() validates server-side\u0027; the exact validation logic was not visible in the patch.",
"Exact affected version range could not be determined from the patch alone; the fix commit is 225 commits after the v2.5.46 tag, suggesting the vulnerability existed in releases around and after v2.5.46, but precise boundaries are unspecified.",
"CVSS UI:P assumes the victim must load an attacker-controlled page; if MISP is deployed behind a strict CSP that blocks cross-origin form submission, exploitability may be reduced, but this is not confirmed by the patch."
],
"commit": "979337b182ae666fe1387342e20e061613657e83",
"confidence": "medium",
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Scottish Government - National Cyber Team"
},
{
"lang": "en",
"type": "remediation developer",
"value": "iglocska"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Claude Opus 5 (1M context)"
},
{
"lang": "en",
"type": "tool",
"value": "Claude Opus 5 (1M context)"
}
],
"cvssRationale": "AV:N: The attack is delivered over the network via a malicious web page. AC:L: CSRF exploitation is straightforward with no race conditions or special timing. AT:N: No special target state is required beyond normal authentication. PR:N: The attacker requires no privileges on the MISP instance. UI:P: The victim must passively load the attacker\u0027s page while authenticated (e.g., click a link or visit a site). VC:N: No confidential data is exposed. VI:L: User-controlled settings (theme, homepage, column visibility) are modified, representing a low integrity impact. VA:N: No availability impact. SC/SI/SA:N: No impact on adjacent or downstream systems.",
"draft": false,
"fixSummary": "The fix removes the three affected actions from the Security component\u0027s unlockedActions list (which had disabled all CSRF checks) and instead registers them under a header-only CSRF token validation mechanism (_csrfTokenHeaderOnly). This requires the X-CSRF-Token header to be present and valid on each request while still permitting the AJAX-style calls that lack traditional form fields. Client-side JavaScript and view templates are updated to include the X-CSRF-Token header (sourced from window.csrfToken) in all AJAX and fetch calls to these endpoints, ensuring legitimate same-origin requests continue to function while cross-origin forged requests are rejected.",
"generatedAt": "2026-09-14T08:59:52.615890Z",
"generator": "patch2vuln.py",
"model": "qwen3.8:27b",
"modelComparison": {
"rankings": [
{
"agreementScore": 9,
"assumptionCount": 4,
"confidence": "medium",
"model": "qwen3.8:27b",
"score": 6
}
],
"selectedModel": "qwen3.8:27b",
"selectionMethod": "deterministic-consensus-v1",
"selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
},
"patchSha256": "287bea96c3ef414dbe0e17b36a12cd0aed2f27c7b28ccc9867338fabf9561a0f",
"patchSummary": "In UserSettingsController::beforeFilter(), the three lines adding eventIndexColumnToggle, setTheme, and setHomePage to $this-\u003eSecurity-\u003eunlockedActions[] are removed and replaced with a single $this-\u003e_csrfTokenHeaderOnly() call covering all four affected actions (including setEventTemplateUserFormMode). In global_menu.ctp (default and UiBeta themes), navbar.ctp (Overmind theme), and misp.js, the jQuery $.ajax() and fetch() calls that invoke setTheme, setHomePage, and eventIndexColumnToggle are updated to include an X-CSRF-Token header populated from window.csrfToken. The Overmind navbar fetch calls also gain credentials: \u0027same-origin\u0027 to ensure cookies are sent with the request.",
"patchTruncated": false,
"patches": [
{
"commit": "979337b182ae666fe1387342e20e061613657e83",
"patchSha256": "287bea96c3ef414dbe0e17b36a12cd0aed2f27c7b28ccc9867338fabf9561a0f",
"source": "https://github.com/MISP/MISP/commit/979337b18.patch",
"sourceUrl": "https://github.com/MISP/MISP/commit/979337b18.patch",
"subject": "fix: [security] Put the user-settings endpoints back under"
}
],
"source": "https://github.com/MISP/MISP/commit/979337b18.patch",
"subject": "fix: [security] Put the user-settings endpoints back under",
"tagVersionBoundary": {
"commits_after_fix": 225,
"repository": "https://github.com/MISP/MISP",
"tag": "v2.5.46",
"version": "2.5.46",
"version_type": "semver"
},
"weaknessRationale": [
{
"cweId": "CWE-352",
"rationale": "The endpoints were explicitly excluded from CSRF validation via the Security component\u0027s unlockedActions mechanism, allowing a cross-origin page to submit state-changing POST requests on behalf of an authenticated user without a valid CSRF token."
}
]
}
}
},
"recordType": "advisory",
"vulnId": "GCVE-1-2026-20226"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "00000000-0000-4000-9000-000000000000",
"cveId": "CVE-2026-90893",
"datePublished": "2026-09-14T09:11:53.023118Z",
"dateReserved": "2026-09-14T09:12:01.736Z",
"dateUpdated": "2026-09-14T09:12:01.892160Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1-2026-20226"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
Mitigation MIT-4
Architecture and Design
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482].
- For example, use anti-CSRF packages such as the OWASP CSRFGuard. [REF-330]
- Another example is the ESAPI Session Management control, which includes a component for CSRF. [REF-45]
Mitigation
Implementation
Ensure that the application is free of cross-site scripting issues (CWE-79), because most CSRF defenses can be bypassed using attacker-controlled script.
Mitigation
Architecture and Design
Generate a unique nonce for each form, place the nonce into the form, and verify the nonce upon receipt of the form. Be sure that the nonce is not predictable (CWE-330). [REF-332]
Mitigation
Architecture and Design
Identify especially dangerous operations. When the user performs a dangerous operation, send a separate confirmation request to ensure that the user intended to perform that operation.
Mitigation
Architecture and Design
- Use the "double-submitted cookie" method as described by Felten and Zeller:
- When a user visits a site, the site should generate a pseudorandom value and set it as a cookie on the user's machine. The site should require every form submission to include this value as a form value and also as a cookie value. When a POST request is sent to the site, the request should only be considered valid if the form value and the cookie value are the same.
- Because of the same-origin policy, an attacker cannot read or modify the value stored in the cookie. To successfully submit a form on behalf of the user, the attacker would have to correctly guess the pseudorandom value. If the pseudorandom value is cryptographically strong, this will be prohibitively difficult.
- This technique requires Javascript, so it may not work for browsers that have Javascript disabled. [REF-331]
Mitigation
Architecture and Design
Do not use the GET method for any request that triggers a state change.
Mitigation
Implementation
Check the HTTP Referer header to see if the request originated from an expected page. This could break legitimate functionality, because users or proxies may have disabled sending the Referer for privacy reasons.
CAPEC-111: JSON Hijacking (aka JavaScript Hijacking)
An attacker targets a system that uses JavaScript Object Notation (JSON) as a transport mechanism between the client and the server (common in Web 2.0 systems using AJAX) to steal possibly confidential information transmitted from the server back to the client inside the JSON object by taking advantage of the loophole in the browser's Same Origin Policy that does not prohibit JavaScript from one website to be included and executed in the context of another website.
CAPEC-462: Cross-Domain Search Timing
An attacker initiates cross domain HTTP / GET requests and times the server responses. The timing of these responses may leak important information on what is happening on the server. Browser's same origin policy prevents the attacker from directly reading the server responses (in the absence of any other weaknesses), but does not prevent the attacker from timing the responses to requests that the attacker issued cross domain.
CAPEC-467: Cross Site Identification
An attacker harvests identifying information about a victim via an active session that the victim's browser has with a social networking site. A victim may have the social networking site open in one tab or perhaps is simply using the "remember me" feature to keep their session with the social networking site active. An attacker induces a payload to execute in the victim's browser that transparently to the victim initiates a request to the social networking site (e.g., via available social network site APIs) to retrieve identifying information about a victim. While some of this information may be public, the attacker is able to harvest this information in context and may use it for further attacks on the user (e.g., spear phishing).
CAPEC-62: Cross Site Request Forgery
An attacker crafts malicious web links and distributes them (via web pages, email, etc.), typically in a targeted manner, hoping to induce users to click on the link and execute the malicious action against some third-party application. If successful, the action embedded in the malicious link will be processed and accepted by the targeted application with the users' privilege level. This type of attack leverages the persistence and implicit trust placed in user session cookies by many web applications today. In such an architecture, once the user authenticates to an application and a session cookie is created on the user's system, all following transactions for that session are authenticated using that cookie including potential actions initiated by an attacker and simply "riding" the existing session cookie.