CWE-352

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-22194",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-09T17:48:17.494091Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-09T18:37:37.903Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "GestSup",
          "vendor": "GestSup",
          "versions": [
            {
              "lessThanOrEqual": "3.2.60",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:gestsup:gestsup:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "3.2.60",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Geoffrey Robert and Valentin Holubec of Akailabs"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulnCheck"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "GestSup versions up to and including 3.2.60 contain a cross-site request forgery (CSRF) vulnerability where the application does not verify the authenticity of client requests. An attacker can induce a logged-in user to submit crafted requests that perform actions with the victim\u0027s privileges. This can be exploited to create privileged accounts by targeting the administrative user creation endpoint.\u003cbr\u003e"
            }
          ],
          "value": "GestSup versions up to and including 3.2.60 contain a cross-site request forgery (CSRF) vulnerability where the application does not verify the authenticity of client requests. An attacker can induce a logged-in user to submit crafted requests that perform actions with the victim\u0027s privileges. This can be exploited to create privileged accounts by targeting the administrative user creation endpoint."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 8.9,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:H/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "CWE-352 Cross-Site Request Forgery (CSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-25T23:41:35.851Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://gestsup.fr/index.php?page=changelog"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/gestsup-csrf-allows-privileged-actions"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "GestSup \u003c= 3.2.60 CSRF Allows Privileged Actions",
      "x_generator": {
        "engine": "vulncheck"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-22194",
    "datePublished": "2026-01-09T16:17:55.920Z",
    "dateReserved": "2026-01-06T16:47:17.184Z",
    "dateUpdated": "2026-05-25T23:41:35.851Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-22030",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-12T18:09:33.609212Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-12T18:09:39.441Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "react-router",
          "vendor": "remix-run",
          "versions": [
            {
              "status": "affected",
              "version": "@remix-run/router \u003c 2.17.3"
            },
            {
              "status": "affected",
              "version": "react-router  \u003e= 7.0.0, \u003c 7.12.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "React Router is a router for React. In @remix-run/server-runtime version prior to 2.17.3. and react-router 7.0.0 through 7.11.0, React Router (or Remix v2) is vulnerable to CSRF attacks on document POST requests to UI routes when using server-side route action handlers in Framework Mode, or when using React Server Actions in the new unstable RSC modes. There is no impact if Declarative Mode (\u003cBrowserRouter\u003e) or Data Mode (createBrowserRouter/\u003cRouterProvider\u003e) is being used. This issue has been patched in @remix-run/server-runtime version 2.17.3 and react-router version 7.12.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-346",
              "description": "CWE-346: Origin Validation Error",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "CWE-352: Cross-Site Request Forgery (CSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-10T02:42:44.603Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/remix-run/react-router/security/advisories/GHSA-h5cw-625j-3rxh",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/remix-run/react-router/security/advisories/GHSA-h5cw-625j-3rxh"
        }
      ],
      "source": {
        "advisory": "GHSA-h5cw-625j-3rxh",
        "discovery": "UNKNOWN"
      },
      "title": "React Router has CSRF issue in Action/Server Action Request Processing"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-22030",
    "datePublished": "2026-01-10T02:42:44.603Z",
    "dateReserved": "2026-01-05T22:30:38.718Z",
    "dateUpdated": "2026-01-12T18:09:39.441Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-21430",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-05T20:32:31.928774Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-05T20:38:09.299Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "emlog",
          "vendor": "emlog",
          "versions": [
            {
              "status": "affected",
              "version": "= 2.5.23"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Emlog is an open source website building system. In version 2.5.23, article creation functionality is vulnerable to cross-site request forgery (CSRF). This can lead to a user being forced to post an article with arbitrary, attacker-controlled content. This, when combined with stored cross-site scripting, leads to account takeover. As of time of publication, no known patched versions are available."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:P",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "CWE-352: Cross-Site Request Forgery (CSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-02T18:44:24.192Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/emlog/emlog/security/advisories/GHSA-2g2w-vmg7-pq4q",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/emlog/emlog/security/advisories/GHSA-2g2w-vmg7-pq4q"
        }
      ],
      "source": {
        "advisory": "GHSA-2g2w-vmg7-pq4q",
        "discovery": "UNKNOWN"
      },
      "title": "Emlog: CSRF chained with stored XSS leads to ATO"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-21430",
    "datePublished": "2026-01-02T18:44:24.192Z",
    "dateReserved": "2025-12-29T03:00:29.274Z",
    "dateUpdated": "2026-01-05T20:38:09.299Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-20704",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-03T15:55:57.052296Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-03T15:56:26.479Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "WRC-X1500GS-B",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.12 and earlier"
            }
          ]
        },
        {
          "product": "WRC-X1500GSA-B",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.12 and earlier"
            }
          ]
        },
        {
          "product": "WRC-X3000GS2-B",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.09 and earlier"
            }
          ]
        },
        {
          "product": "WRC-X3000GS2-W",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.09 and earlier"
            }
          ]
        },
        {
          "product": "WRC-X3000GS2A-B",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.09 and earlier"
            }
          ]
        },
        {
          "product": "WRC-X3000GST2-B",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.06 and earlier"
            }
          ]
        },
        {
          "product": "WRC-X1800GS-B",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.19 and earlier"
            }
          ]
        },
        {
          "product": "WRC-X1800GSA-B",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.19 and earlier"
            }
          ]
        },
        {
          "product": "WRC-X1800GSH-B",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.19 and earlier"
            }
          ]
        },
        {
          "product": "WRC-X6000QS-G",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.14 and earlier"
            }
          ]
        },
        {
          "product": "WRC-X6000QSA-G",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.14 and earlier"
            }
          ]
        },
        {
          "product": "WRC-X6000XS-G",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.12 and earlier"
            }
          ]
        },
        {
          "product": "WRC-X6000XST-G",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.16 and earlier"
            }
          ]
        },
        {
          "product": "WRC-XE5400GS-G",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.13 and earlier"
            }
          ]
        },
        {
          "product": "WRC-XE5400GSA-G",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.13 and earlier"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-site request forgery vulnerability exists in ELECOM wireless LAN products. If a user accesses a malicious page while logged-in to the affected product, unintended operations may be performed."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
            "version": "3.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "Cross-site request forgery (CSRF)",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-12T08:09:07.849Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://www.elecom.co.jp/news/security/20260203-01/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN94012927/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2026-20704",
    "datePublished": "2026-02-03T06:56:42.019Z",
    "dateReserved": "2026-01-30T01:42:47.600Z",
    "dateUpdated": "2026-05-12T08:09:07.849Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-20296",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-15T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-16T03:55:54.695Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Splunk Enterprise",
          "vendor": "Splunk",
          "versions": [
            {
              "lessThan": "10.4.1",
              "status": "affected",
              "version": "10.4",
              "versionType": "custom"
            },
            {
              "lessThan": "10.2.5",
              "status": "affected",
              "version": "10.2",
              "versionType": "custom"
            },
            {
              "lessThan": "10.0.8",
              "status": "affected",
              "version": "10.0",
              "versionType": "custom"
            },
            {
              "lessThan": "9.4.13",
              "status": "affected",
              "version": "9.4",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Splunk Cloud Platform",
          "vendor": "Splunk",
          "versions": [
            {
              "lessThan": "10.5.2605.0",
              "status": "affected",
              "version": "10.5.2605",
              "versionType": "custom"
            },
            {
              "lessThan": "10.4.2604.7",
              "status": "affected",
              "version": "10.4.2604",
              "versionType": "custom"
            },
            {
              "lessThan": "10.3.2512.16",
              "status": "affected",
              "version": "10.3.2512",
              "versionType": "custom"
            },
            {
              "lessThan": "10.2.2510.18",
              "status": "affected",
              "version": "10.2.2510",
              "versionType": "custom"
            },
            {
              "lessThan": "10.1.2507.24",
              "status": "affected",
              "version": "10.1.2507",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2026-07-15T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "In Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.8, and 9.4.13, and Splunk Cloud Platform versions below 10.5.2605.0, 10.4.2604.7, 10.3.2512.16, 10.2.2510.18, and 10.1.2507.24, an attacker could trick a user that holds a role with the `list_deployment_server` capability into running arbitrary Search Processing Language (SPL) searches on their behalf as `splunk-system-user`, allowing for access to stored credentials and indexed data.\u003cbr\u003e\u003cbr\u003eThe vulnerability is possible because Deployment Server endpoints in Splunk Web do not validate Cross-Site Request Forgery (CSRF) tokens on GET requests, and caller-supplied input is not correctly neutralized before it is placed into an SPL search."
            }
          ],
          "value": "In Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.8, and 9.4.13, and Splunk Cloud Platform versions below 10.5.2605.0, 10.4.2604.7, 10.3.2512.16, 10.2.2510.18, and 10.1.2507.24, an attacker could trick a user that holds a role with the `list_deployment_server` capability into running arbitrary Search Processing Language (SPL) searches on their behalf as `splunk-system-user`, allowing for access to stored credentials and indexed data.\u003cbr\u003e\u003cbr\u003eThe vulnerability is possible because Deployment Server endpoints in Splunk Web do not validate Cross-Site Request Forgery (CSRF) tokens on GET requests, and caller-supplied input is not correctly neutralized before it is placed into an SPL search."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.",
              "lang": "en",
              "type": "cwe"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-15T17:18:23.696Z",
        "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "shortName": "cisco"
      },
      "references": [
        {
          "url": "https://advisory.splunk.com/advisories/SVD-2026-0702"
        }
      ],
      "source": {
        "advisory": "SVD-2026-0702"
      },
      "title": "SPL Command Safeguards Bypass through Cross-Site Request Forgery (CSRF) in Deployment Server in Splunk Enterprise"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
    "assignerShortName": "cisco",
    "cveId": "CVE-2026-20296",
    "datePublished": "2026-07-15T17:18:23.696Z",
    "dateReserved": "2025-10-08T11:59:15.407Z",
    "dateUpdated": "2026-07-16T03:55:54.695Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "modules": [
            "WorkflowsController",
            "Workflows module execution"
          ],
          "product": "MISP",
          "programFiles": [
            "app/Controller/WorkflowsController.php",
            "app/View/Elements/Workflows/execute_module.ctp"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.47",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 5 (1M context)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMISP\u0027s WorkflowsController exposed the moduleStatelessExecution action in the Security component\u0027s unlockedActions list. In CakePHP, listing an action in unlockedActions disables both the CSRF token check and the field hash validation for that action. Because moduleStatelessExecution executes a workflow module\u0027s exec() method with caller-supplied input and parameters, the absence of CSRF protection allowed an attacker to craft a cross-site form post (or equivalent cross-origin request) that, when submitted by an authenticated site administrator, would cause the administrator\u0027s browser to invoke the action on the MISP instance.\u0026nbsp;\u003c/p\u003e\u003cp\u003eThe attacker could select any workflow module to execute, including action modules that write blocklist and warninglist entries, and supply arbitrary input and parameters of their choosing. This constitutes a cross-site request forgery (CSRF) vulnerability with high integrity impact on the MISP instance\u0027s security-related data.\u0026nbsp;\u003c/p\u003e\u003cp\u003eThe vulnerability was identified during an internal security review and was not externally reported. The fix is included in MISP v2.5.47.\u003c/p\u003e"
            }
          ],
          "value": "MISP\u0027s WorkflowsController exposed the moduleStatelessExecution action in the Security component\u0027s unlockedActions list. In CakePHP, listing an action in unlockedActions disables both the CSRF token check and the field hash validation for that action. Because moduleStatelessExecution executes a workflow module\u0027s exec() method with caller-supplied input and parameters, the absence of CSRF protection allowed an attacker to craft a cross-site form post (or equivalent cross-origin request) that, when submitted by an authenticated site administrator, would cause the administrator\u0027s browser to invoke the action on the MISP instance.\u00a0\n\nThe attacker could select any workflow module to execute, including action modules that write blocklist and warninglist entries, and supply arbitrary input and parameters of their choosing. This constitutes a cross-site request forgery (CSRF) vulnerability with high integrity impact on the MISP instance\u0027s security-related data.\u00a0\n\nThe vulnerability was identified during an internal security review and was not externally reported. The fix is included in MISP v2.5.47."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-124",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-124 Cross-Site Request Forgery"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "CWE-352 Cross-Site Request Forgery (CSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "orgId": "00000000-0000-4000-9000-000000000000"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/f05e0d1c2"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe moduleStatelessExecution action is removed from the unlockedActions list, restoring the CSRF token check. A new mechanism (_csrfTokenHeaderOnly) is introduced that enforces the CSRF token while exempting only the field hash, which the legitimate caller (the module dialog) cannot produce because it posts a hand-built object. The module dialog\u0027s AJAX request is updated to send the CSRF token in the X-CSRF-Token header, satisfying the token check without requiring a field hash.\u003c/p\u003e"
            }
          ],
          "value": "The moduleStatelessExecution action is removed from the unlockedActions list, restoring the CSRF token check. A new mechanism (_csrfTokenHeaderOnly) is introduced that enforces the CSRF token while exempting only the field hash, which the legitimate caller (the module dialog) cannot produce because it posts a hand-built object. The module dialog\u0027s AJAX request is updated to send the CSRF token in the X-CSRF-Token header, satisfying the token check without requiring a field hash."
        }
      ],
      "title": "MISP CSRF vulnerability in workflow moduleStatelessExecution allows cross-site execution of workflow modules",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "full",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The affected version range is inferred from the tag_version_boundary metadata (v2.5.47, 6 commits after fix), implying the fix is included in v2.5.47 and prior versions are affected. The exact introduction version of the vulnerable code is unknown.",
                  "UI:A is used because the CSRF attack requires the victim to actively navigate to the attacker\u0027s page or click a link; a purely passive load (e.g., embedded iframe auto-submit) would map to UI:P, but the commit message describes a \u0027cross-site form post\u0027 which typically requires at least a page visit.",
                  "SI:N is chosen because the evidence only demonstrates integrity impact on MISP\u0027s own blocklist and warninglist data; no evidence supports impact on downstream or external systems.",
                  "The CAPEC-124 mapping is confident based on the explicit description of a cross-site form post in the commit message.",
                  "The commit message states the issue was \u0027found during the internal review, not externally reported,\u0027 but does not explicitly name a finder; therefore no finder credit is assigned.",
                  "The _csrfTokenHeaderOnly method is referenced in the patch but its implementation is not shown; it is assumed to enforce CSRF token validation while exempting the field hash, as described in the commit message."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-124",
                    "rationale": "The attack pattern described in the commit message is a cross-site form post that causes an authenticated site admin to execute a workflow module with attacker-chosen parameters. This maps directly to CAPEC-124, which describes an attacker exploiting the trust a web application places in a user\u0027s browser session to perform unauthorized actions. The mapping is confident because the commit message explicitly describes a cross-site form post bypassing CSRF protection."
                  }
                ],
                "commit": "f05e0d1c263b211108644fe6f1600ad7fde9b915",
                "confidence": "high",
                "credits": [
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 5 (1M context)"
                  }
                ],
                "cvssRationale": "AV:N: The attack is delivered over the network via a malicious web page. AC:L: Crafting a cross-site form post is straightforward. AT:N: No special conditions or timing are required. PR:N: The attacker requires no account or privileges on the MISP instance. UI:A: The victim (a site admin) must actively visit the attacker-controlled page or click a link that triggers the form submission. VC:N: No confidentiality impact is evident. VI:H: The attacker can write arbitrary blocklist and warninglist entries, significantly compromising the integrity of MISP\u0027s security data. VA:N: No availability impact. SC/SI/SA:N: No evidence of impact on other systems beyond MISP itself.",
                "fixSummary": "The moduleStatelessExecution action is removed from the unlockedActions list, restoring the CSRF token check. A new mechanism (_csrfTokenHeaderOnly) is introduced that enforces the CSRF token while exempting only the field hash, which the legitimate caller (the module dialog) cannot produce because it posts a hand-built object. The module dialog\u0027s AJAX request is updated to send the CSRF token in the X-CSRF-Token header, satisfying the token check without requiring a field hash.",
                "generatedAt": "2026-09-22T12:15:58.553959Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 9,
                      "assumptionCount": 6,
                      "confidence": "high",
                      "model": "qwen3.8:27b",
                      "score": 5
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "3f8a00ca29761ed6a3986633e60ec67a964e3bfc1dc1e2631a2c2d80df827d30",
                "patchSummary": "In WorkflowsController::beforeFilter(), the line adding \u0027moduleStatelessExecution\u0027 to $this-\u003eSecurity-\u003eunlockedActions is replaced with a call to $this-\u003e_csrfTokenHeaderOnly([\u0027moduleStatelessExecution\u0027]), which enforces CSRF token validation while waiving only the field hash requirement. In execute_module.ctp, the jQuery $.ajax() call is modified to include the header \u0027X-CSRF-Token\u0027 populated from window.csrfToken, so the legitimate client-side caller passes the token check via the header rather than a form field.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "f05e0d1c263b211108644fe6f1600ad7fde9b915",
                    "patchSha256": "3f8a00ca29761ed6a3986633e60ec67a964e3bfc1dc1e2631a2c2d80df827d30",
                    "source": "https://github.com/MISP/MISP/commit/f05e0d1c2.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/f05e0d1c2.patch",
                    "subject": "fix: [security] Keep the CSRF check on stateless workflow"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/f05e0d1c2.patch",
                "subject": "fix: [security] Keep the CSRF check on stateless workflow",
                "tagVersionBoundary": {
                  "commits_after_fix": 6,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.47",
                  "version": "2.5.47",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-352",
                    "rationale": "The vulnerable action was placed in unlockedActions, which disabled the CSRF token check. This allowed a cross-site form post to trigger a state-changing action (workflow module execution) on behalf of an authenticated administrator, which is the textbook definition of CSRF."
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20261"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "00000000-0000-4000-9000-000000000000",
    "cveId": "CVE-2026-95658",
    "datePublished": "2026-09-22T12:31:11.850218Z",
    "dateReserved": "2026-09-22T12:31:20.344Z",
    "dateUpdated": "2026-09-22T12:31:20.402691Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1-2026-20261"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "modules": [
            "EventReportsController",
            "NoticelistsController",
            "ServersController",
            "WorkflowsController"
          ],
          "product": "MISP",
          "programFiles": [
            "app/Controller/EventReportsController.php",
            "app/Controller/NoticelistsController.php",
            "app/Controller/ServersController.php",
            "app/Controller/WorkflowsController.php",
            "app/View/EventReports/managed_imported_pictures.ctp"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.46",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 5 (1M context)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e\u003c/p\u003e\u003cp\u003eAffected versions of MISP expose several state-changing controller actions without restricting them to POST.\u003c/p\u003e\n\u003cp\u003eThe affected actions are:\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003ccode\u003e\u2003-\u0026nbsp;EventReportsController::purgeUnusedPictures()\u003c/code\u003e\n\u003cbr\u003e\u003ccode\u003e\u2003-\u0026nbsp;NoticelistsController::enableNoticelist()\u003c/code\u003e\n\u003cbr\u003e\u003ccode\u003e\u2003-\u0026nbsp;ServersController::removeOrphanedCorrelations()\u003c/code\u003e\n\u003cbr\u003e\u003cdiv\u003e\u003ccode\u003e\u2003- WorkflowsController::rebuildRedis()\u003c/code\u003e\u003c/div\u003e\u003cdiv\u003e\u003ccode\u003e\u003cbr\u003e\u003c/code\u003e\u003c/div\u003e\u003cp\u003e\u003ccode\u003e\u003c/code\u003e\u003c/p\u003e\u003cp\u003eThe patch adds \u003ccode\u003eallowMethod([\u0027post\u0027])\u003c/code\u003e to each action, preventing them from being triggered through ordinary GET requests.\u003c/p\u003e\n\u003cp\u003eFor \u003ccode\u003epurgeUnusedPictures()\u003c/code\u003e, the corresponding UI previously used \u003ccode\u003e$.get()\u003c/code\u003e. The fix converts that request to POST and supplies \u003ccode\u003eX-CSRF-Token\u003c/code\u003e, while the controller enables header-only CSRF validation for that AJAX action.\u003c/p\u003e\n\u003cp\u003eBecause GET requests can be induced cross-origin through links, images, redirects, or navigation, accepting GET for these state-changing operations can let an attacker trigger them using the authenticated victim\u0027s session.\u003c/p\u003e\u003cp\u003eVersion affected: \u22642.5.45\u003cbr\u003e\u003c/p\u003e\u003cp\u003e\u003c/p\u003e"
            }
          ],
          "value": "Affected versions of MISP expose several state-changing controller actions without restricting them to POST.\n\n\nThe affected actions are:\n\n\n\n\u2003-\u00a0EventReportsController::purgeUnusedPictures()\n\n\u2003-\u00a0NoticelistsController::enableNoticelist()\n\n\u2003-\u00a0ServersController::removeOrphanedCorrelations()\n\n\u2003- WorkflowsController::rebuildRedis()\n\n\n\n\n\n\nThe patch adds allowMethod([\u0027post\u0027]) to each action, preventing them from being triggered through ordinary GET requests.\n\n\nFor purgeUnusedPictures(), the corresponding UI previously used $.get(). The fix converts that request to POST and supplies X-CSRF-Token, while the controller enables header-only CSRF validation for that AJAX action.\n\n\nBecause GET requests can be induced cross-origin through links, images, redirects, or navigation, accepting GET for these state-changing operations can let an attacker trigger them using the authenticated victim\u0027s session.\n\nVersion affected: \u22642.5.45"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-62",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-62 Cross Site Request Forgery"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "CWE-352 Cross-Site Request Forgery (CSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "orgId": "00000000-0000-4000-9000-000000000000"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/b4a5486b5"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe vulnerability is remediated by restricting all four state-changing actions to accept only POST requests via the CakePHP allowMethod() guard. Additionally, the client-side JavaScript for purgeUnusedPictures is updated to issue a POST request with the page\u0027s CSRF token in the X-CSRF-Token header, and a beforeFilter() hook is added to EventReportsController to configure header-only CSRF token validation for that specific action, since it is invoked via hand-built AJAX rather than a rendered form.\u003c/p\u003e"
            }
          ],
          "value": "The vulnerability is remediated by restricting all four state-changing actions to accept only POST requests via the CakePHP allowMethod() guard. Additionally, the client-side JavaScript for purgeUnusedPictures is updated to issue a POST request with the page\u0027s CSRF token in the X-CSRF-Token header, and a beforeFilter() hook is added to EventReportsController to configure header-only CSRF token validation for that specific action, since it is invoked via hand-built AJAX rather than a rendered form."
        }
      ],
      "title": "MISP: State-changing actions accessible via GET request enabling CSRF",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "review",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The fix commit is 196 commits before the v2.5.46 tag, implying the vulnerability existed in versions prior to v2.5.46; exact affected version range is not explicitly stated in the patch.",
                  "MISP requires user authentication to access the affected endpoints; the PR:L assumption is based on MISP\u0027s standard authentication model.",
                  "The CSRF token mechanism in CakePHP (the framework used by MISP) is assumed to protect POST requests but not GET requests, consistent with the patch\u0027s own comments.",
                  "The vulnerability was found during internal review and was not externally reported, per the commit message."
                ],
                "commit": "b4a5486b5ddd078dc11248cbd7f21725fb1f43cf",
                "confidence": "high",
                "credits": [
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 5 (1M context)"
                  }
                ],
                "cvssRationale": "AV:N: The attack is delivered over the network (e.g., a malicious link or page). AC:L: No special race conditions or complex setup are required; a simple GET URL suffices. AT:N: No prior compromise or manipulation of the target system is needed. PR:L: The attacker requires the victim to be an authenticated MISP user; the attacker themselves need not be authenticated. UI:A: The victim must actively interact (click a link or navigate to a crafted page) to trigger the forged request. VC:N: No confidential data is exposed by the affected actions. VI:L: Integrity impact is low; the actions cause limited state changes (deleting unused pictures, toggling a noticelist, removing orphaned correlations, rebuilding a cache) rather than corrupting critical data. VA:N: No meaningful availability impact; the actions do not cause denial of service. SC/SI/SA:N: No impact on subsequent systems.",
                "draft": false,
                "fixSummary": "The vulnerability is remediated by restricting all four state-changing actions to accept only POST requests via the CakePHP allowMethod() guard. Additionally, the client-side JavaScript for purgeUnusedPictures is updated to issue a POST request with the page\u0027s CSRF token in the X-CSRF-Token header, and a beforeFilter() hook is added to EventReportsController to configure header-only CSRF token validation for that specific action, since it is invoked via hand-built AJAX rather than a rendered form.",
                "generatedAt": "2026-09-15T09:10:36.581856Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 9,
                      "assumptionCount": 4,
                      "confidence": "high",
                      "model": "qwen3.8:27b",
                      "score": 7
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "adc31514b96a99a411ca1ed5a31abf99642d19de3a09f536e62310b298d2552b",
                "patchSummary": "Adds $this-\u003erequest-\u003eallowMethod([\u0027post\u0027]) to purgeUnusedPictures, enableNoticelist, removeOrphanedCorrelations, and rebuildRedis. Adds a beforeFilter() method to EventReportsController calling _csrfTokenHeaderOnly([\u0027purgeUnusedPictures\u0027]) to permit CSRF token validation via the X-CSRF-Token header. Updates the managed_imported_pictures.ctp view to replace $.get() with $.ajax() using type \u0027post\u0027 and the X-CSRF-Token header. Adds REST response handling and flash/redirect logic to rebuildRedis for consistency with other actions.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "b4a5486b5ddd078dc11248cbd7f21725fb1f43cf",
                    "patchSha256": "adc31514b96a99a411ca1ed5a31abf99642d19de3a09f536e62310b298d2552b",
                    "source": "https://github.com/MISP/MISP/commit/b4a5486b5.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/b4a5486b5.patch",
                    "subject": "fix: [security] Require POST for four remaining"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/b4a5486b5.patch",
                "subject": "fix: [security] Require POST for four remaining",
                "tagVersionBoundary": {
                  "commits_after_fix": 196,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.46",
                  "version": "2.5.46",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-352",
                    "rationale": "The root cause is that state-changing endpoints accept GET requests, which are not protected by the framework\u0027s CSRF token mechanism. This allows an attacker to forge requests on behalf of an authenticated user via links, auto-loading resources, or other passive/active user interactions, which is the defining characteristic of CSRF."
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20242"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "00000000-0000-4000-9000-000000000000",
    "cveId": "CVE-2026-91857",
    "datePublished": "2026-09-15T09:14:33.110236Z",
    "dateReserved": "2026-09-15T09:14:39.778Z",
    "dateUpdated": "2026-09-15T09:14:40.600582Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1-2026-20242"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "misp",
          "repo": "https://github.com/MISP/MISP",
          "vendor": "misp",
          "versions": [
            {
              "lessThanOrEqual": "2.4.45",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Andras Iklody"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Scottish Government - National Cyber Team"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Peter James"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMISP contains a cross-site request forgery (CSRF) vulnerability in the sharing group quick-edit functionality. The \u003ccode\u003eaddOrg\u003c/code\u003e, \u003ccode\u003eremoveOrg\u003c/code\u003e, \u003ccode\u003eaddServer\u003c/code\u003e, and \u003ccode\u003eremoveServer\u003c/code\u003e actions share the \u003ccode\u003e__initialiseSGQuickEdit()\u003c/code\u003e helper, where the HTTP method validation intended to restrict these operations to POST requests was commented out.\u003c/p\u003e\u003cp\u003eAs a result, these state-changing actions could be invoked using GET requests. An attacker could craft a URL targeting one of the affected actions and cause an authenticated MISP user with sufficient privileges to request it, for example through a malicious link or embedded web resource.\u003c/p\u003e\u003cp\u003eSuccessful exploitation could modify the membership of a MISP sharing group without the victim intentionally performing the operation. Depending on the action performed, an attacker could add or remove organisations or servers from a sharing group, potentially granting unintended access to information distributed through that sharing group or disrupting legitimate information sharing.\u003c/p\u003e\u003cp\u003eThe patch restores HTTP method enforcement centrally in \u003ccode\u003e__initialiseSGQuickEdit()\u003c/code\u003e by calling \u003ccode\u003eallowMethod([\u0027post\u0027])\u003c/code\u003e, ensuring that all four affected quick-edit operations require POST requests and are therefore subject to the application\u0027s normal protections for state-changing requests.\u003c/p\u003e\u003cbr\u003e"
            }
          ],
          "value": "MISP contains a cross-site request forgery (CSRF) vulnerability in the sharing group quick-edit functionality. The addOrg, removeOrg, addServer, and removeServer actions share the __initialiseSGQuickEdit() helper, where the HTTP method validation intended to restrict these operations to POST requests was commented out.\n\nAs a result, these state-changing actions could be invoked using GET requests. An attacker could craft a URL targeting one of the affected actions and cause an authenticated MISP user with sufficient privileges to request it, for example through a malicious link or embedded web resource.\n\nSuccessful exploitation could modify the membership of a MISP sharing group without the victim intentionally performing the operation. Depending on the action performed, an attacker could add or remove organisations or servers from a sharing group, potentially granting unintended access to information distributed through that sharing group or disrupting legitimate information sharing.\n\nThe patch restores HTTP method enforcement centrally in __initialiseSGQuickEdit() by calling allowMethod([\u0027post\u0027]), ensuring that all four affected quick-edit operations require POST requests and are therefore subject to the application\u0027s normal protections for state-changing requests."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-62",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-62 Cross Site Request Forgery"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "privilegesRequired": "HIGH",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "LOW",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "CWE-352 Cross-Site Request Forgery (CSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "orgId": "00000000-0000-4000-9000-000000000000"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/3060d93cb"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "MISP Sharing Group Quick-Edit Actions Allow CSRF via State-Changing GET Requests",
      "x_gcve": [
        {
          "recordType": "advisory",
          "vulnId": "gcve-1-2026-20235"
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "00000000-0000-4000-9000-000000000000",
    "cveId": "CVE-2026-85546",
    "datePublished": "2026-09-04T09:27:00.000Z",
    "dateReserved": "2026-09-04T09:27:00.000Z",
    "dateUpdated": "2026-09-10T07:44:51.336437Z",
    "requesterUserId": "00000000-0000-4000-9000-000000000000",
    "serial": 1,
    "state": "PUBLISHED",
    "vulnId": "gcve-1-2026-20235"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "modules": [
            "UserSettingsController",
            "app/Controller/UserSettingsController.php"
          ],
          "product": "MISP",
          "programFiles": [
            "app/Controller/UserSettingsController.php",
            "app/View/Elements/global_menu.ctp",
            "app/View/Themed/Overmind/Elements/navbar.ctp",
            "app/View/Themed/UiBeta/Elements/global_menu.ctp",
            "app/webroot/js/misp.js"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.46",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Scottish Government - National Cyber Team"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 5 (1M context)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMISP contains a Cross-Site Request Forgery (CSRF) vulnerability in the UserSettingsController. The actions setTheme, setHomePage, and eventIndexColumnToggle were explicitly added to the Security component\u0027s unlockedActions list, which disabled all CSRF validation (both token and field-hash checks) for those endpoints. Because these endpoints accept POST requests and modify per-user application state (theme selection, default homepage URL, and event index column visibility), an attacker who can induce a logged-in MISP user to load a malicious page (e.g., via a crafted link, embedded image, or auto-submitting form) can forge requests that alter the victim\u0027s settings without their knowledge or consent. The most impactful action is setHomePage, which allows an attacker to redirect the victim\u0027s default landing page to an arbitrary attacker-controlled URL, potentially facilitating phishing or further social engineering. The setTheme action can alter the user\u0027s visual theme, and eventIndexColumnToggle can change which columns are displayed in the event index view. No authentication bypass is involved; the victim must already be authenticated to MISP. The vulnerability was reported by the Scottish Government National Cyber Team.\u003c/p\u003e\u003cp\u003eVersion affected: \u22642.5.45\u003cbr\u003e\u003c/p\u003e"
            }
          ],
          "value": "MISP contains a Cross-Site Request Forgery (CSRF) vulnerability in the UserSettingsController. The actions setTheme, setHomePage, and eventIndexColumnToggle were explicitly added to the Security component\u0027s unlockedActions list, which disabled all CSRF validation (both token and field-hash checks) for those endpoints. Because these endpoints accept POST requests and modify per-user application state (theme selection, default homepage URL, and event index column visibility), an attacker who can induce a logged-in MISP user to load a malicious page (e.g., via a crafted link, embedded image, or auto-submitting form) can forge requests that alter the victim\u0027s settings without their knowledge or consent. The most impactful action is setHomePage, which allows an attacker to redirect the victim\u0027s default landing page to an arbitrary attacker-controlled URL, potentially facilitating phishing or further social engineering. The setTheme action can alter the user\u0027s visual theme, and eventIndexColumnToggle can change which columns are displayed in the event index view. No authentication bypass is involved; the victim must already be authenticated to MISP. The vulnerability was reported by the Scottish Government National Cyber Team.\n\nVersion affected: \u22642.5.45"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-62",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-62 Cross Site Request Forgery"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "CWE-352 Cross-Site Request Forgery (CSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "orgId": "00000000-0000-4000-9000-000000000000"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/979337b18"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe fix removes the three affected actions from the Security component\u0027s unlockedActions list (which had disabled all CSRF checks) and instead registers them under a header-only CSRF token validation mechanism (_csrfTokenHeaderOnly). This requires the X-CSRF-Token header to be present and valid on each request while still permitting the AJAX-style calls that lack traditional form fields. Client-side JavaScript and view templates are updated to include the X-CSRF-Token header (sourced from window.csrfToken) in all AJAX and fetch calls to these endpoints, ensuring legitimate same-origin requests continue to function while cross-origin forged requests are rejected.\u003c/p\u003e"
            }
          ],
          "value": "The fix removes the three affected actions from the Security component\u0027s unlockedActions list (which had disabled all CSRF checks) and instead registers them under a header-only CSRF token validation mechanism (_csrfTokenHeaderOnly). This requires the X-CSRF-Token header to be present and valid on each request while still permitting the AJAX-style calls that lack traditional form fields. Client-side JavaScript and view templates are updated to include the X-CSRF-Token header (sourced from window.csrfToken) in all AJAX and fetch calls to these endpoints, ensuring legitimate same-origin requests continue to function while cross-origin forged requests are rejected."
        }
      ],
      "title": "MISP UserSettingsController CSRF Protection Bypass on setTheme, setHomePage, and eventIndexColumnToggle Endpoints",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "review",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The MISP instance is assumed to be deployed in a standard configuration where the Security component\u0027s CSRF protection is enabled by default; if an operator had globally disabled CSRF checks, this specific vulnerability would be subsumed by that broader misconfiguration.",
                  "The setHomePage endpoint is assumed to accept an arbitrary URL path as its argument based on the patch comment stating \u0027a single path the user picks anyway and which setSetting() validates server-side\u0027; the exact validation logic was not visible in the patch.",
                  "Exact affected version range could not be determined from the patch alone; the fix commit is 225 commits after the v2.5.46 tag, suggesting the vulnerability existed in releases around and after v2.5.46, but precise boundaries are unspecified.",
                  "CVSS UI:P assumes the victim must load an attacker-controlled page; if MISP is deployed behind a strict CSP that blocks cross-origin form submission, exploitability may be reduced, but this is not confirmed by the patch."
                ],
                "commit": "979337b182ae666fe1387342e20e061613657e83",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "reporter",
                    "value": "Scottish Government - National Cyber Team"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 5 (1M context)"
                  },
                  {
                    "lang": "en",
                    "type": "tool",
                    "value": "Claude Opus 5 (1M context)"
                  }
                ],
                "cvssRationale": "AV:N: The attack is delivered over the network via a malicious web page. AC:L: CSRF exploitation is straightforward with no race conditions or special timing. AT:N: No special target state is required beyond normal authentication. PR:N: The attacker requires no privileges on the MISP instance. UI:P: The victim must passively load the attacker\u0027s page while authenticated (e.g., click a link or visit a site). VC:N: No confidential data is exposed. VI:L: User-controlled settings (theme, homepage, column visibility) are modified, representing a low integrity impact. VA:N: No availability impact. SC/SI/SA:N: No impact on adjacent or downstream systems.",
                "draft": false,
                "fixSummary": "The fix removes the three affected actions from the Security component\u0027s unlockedActions list (which had disabled all CSRF checks) and instead registers them under a header-only CSRF token validation mechanism (_csrfTokenHeaderOnly). This requires the X-CSRF-Token header to be present and valid on each request while still permitting the AJAX-style calls that lack traditional form fields. Client-side JavaScript and view templates are updated to include the X-CSRF-Token header (sourced from window.csrfToken) in all AJAX and fetch calls to these endpoints, ensuring legitimate same-origin requests continue to function while cross-origin forged requests are rejected.",
                "generatedAt": "2026-09-14T08:59:52.615890Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 9,
                      "assumptionCount": 4,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 6
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "287bea96c3ef414dbe0e17b36a12cd0aed2f27c7b28ccc9867338fabf9561a0f",
                "patchSummary": "In UserSettingsController::beforeFilter(), the three lines adding eventIndexColumnToggle, setTheme, and setHomePage to $this-\u003eSecurity-\u003eunlockedActions[] are removed and replaced with a single $this-\u003e_csrfTokenHeaderOnly() call covering all four affected actions (including setEventTemplateUserFormMode). In global_menu.ctp (default and UiBeta themes), navbar.ctp (Overmind theme), and misp.js, the jQuery $.ajax() and fetch() calls that invoke setTheme, setHomePage, and eventIndexColumnToggle are updated to include an X-CSRF-Token header populated from window.csrfToken. The Overmind navbar fetch calls also gain credentials: \u0027same-origin\u0027 to ensure cookies are sent with the request.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "979337b182ae666fe1387342e20e061613657e83",
                    "patchSha256": "287bea96c3ef414dbe0e17b36a12cd0aed2f27c7b28ccc9867338fabf9561a0f",
                    "source": "https://github.com/MISP/MISP/commit/979337b18.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/979337b18.patch",
                    "subject": "fix: [security] Put the user-settings endpoints back under"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/979337b18.patch",
                "subject": "fix: [security] Put the user-settings endpoints back under",
                "tagVersionBoundary": {
                  "commits_after_fix": 225,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.46",
                  "version": "2.5.46",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-352",
                    "rationale": "The endpoints were explicitly excluded from CSRF validation via the Security component\u0027s unlockedActions mechanism, allowing a cross-origin page to submit state-changing POST requests on behalf of an authenticated user without a valid CSRF token."
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20226"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "00000000-0000-4000-9000-000000000000",
    "cveId": "CVE-2026-90893",
    "datePublished": "2026-09-14T09:11:53.023118Z",
    "dateReserved": "2026-09-14T09:12:01.736Z",
    "dateUpdated": "2026-09-14T09:12:01.892160Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1-2026-20226"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "misp",
          "repo": "https://github.com/MISP/MISP/",
          "vendor": "misp",
          "versions": [
            {
              "lessThanOrEqual": "2.5.45",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Andras Iklody"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Scottish Government - National Cyber Team"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Peter James"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eA cross-site request forgery (CSRF) vulnerability exists in MISP due to form-security and CSRF protections being disabled based on whether an incoming request was identified as a REST request.\u003c/p\u003e\u003cp\u003eMISP\u0027s REST detection can be influenced by request properties such as the URL suffix or the HTTP \u003ccode\u003eAccept\u003c/code\u003e header. Because \u003ccode\u003eAccept: application/json\u003c/code\u003e can be supplied by a cross-origin page without requiring a CORS preflight, an attacker could cause a request originating from another website to be treated as REST traffic. MISP would consequently disable its normal form-security and CSRF validation even though the request was authenticated using the victim\u0027s existing browser session.\u003c/p\u003e\u003cp\u003eAn unauthenticated remote attacker could exploit this behavior by convincing an authenticated MISP user to visit or interact with a malicious web page. The attacker\u0027s page could then issue crafted requests to susceptible state-changing MISP endpoints using the victim\u0027s privileges. Depending on the permissions of the victim and the targeted endpoint, this could allow unauthorized modification, creation, publication, or removal of data and other state changes.\u003c/p\u003e\u003cp\u003eThe vulnerability originates from granting the form-security exemption based on \u003ccode\u003e_isRest()\u003c/code\u003e rather than on the authentication mechanism used by the request. The patch changes this behavior so that CSRF and form-security exemptions are granted only when the request actually carries a MISP API key. Session-authenticated REST-style requests remain subject to CSRF protection.\u003cbr\u003eThe fix also introduces support for transmitting CSRF tokens through the \u003ccode\u003eX-CSRF-Token\u003c/code\u003e header for legitimate same-origin AJAX requests. Such a header cannot normally be attached by a cross-origin page without triggering a CORS preflight, preventing it from being used to reproduce the original attack.\u003c/p\u003e\u003cbr\u003e"
            }
          ],
          "value": "A cross-site request forgery (CSRF) vulnerability exists in MISP due to form-security and CSRF protections being disabled based on whether an incoming request was identified as a REST request.\n\nMISP\u0027s REST detection can be influenced by request properties such as the URL suffix or the HTTP Accept header. Because Accept: application/json can be supplied by a cross-origin page without requiring a CORS preflight, an attacker could cause a request originating from another website to be treated as REST traffic. MISP would consequently disable its normal form-security and CSRF validation even though the request was authenticated using the victim\u0027s existing browser session.\n\nAn unauthenticated remote attacker could exploit this behavior by convincing an authenticated MISP user to visit or interact with a malicious web page. The attacker\u0027s page could then issue crafted requests to susceptible state-changing MISP endpoints using the victim\u0027s privileges. Depending on the permissions of the victim and the targeted endpoint, this could allow unauthorized modification, creation, publication, or removal of data and other state changes.\n\nThe vulnerability originates from granting the form-security exemption based on _isRest() rather than on the authentication mechanism used by the request. The patch changes this behavior so that CSRF and form-security exemptions are granted only when the request actually carries a MISP API key. Session-authenticated REST-style requests remain subject to CSRF protection.\nThe fix also introduces support for transmitting CSRF tokens through the X-CSRF-Token header for legitimate same-origin AJAX requests. Such a header cannot normally be attached by a cross-origin page without triggering a CORS preflight, preventing it from being used to reproduce the original attack."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-62",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-62 Cross Site Request Forgery"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.2,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "LOW",
            "userInteraction": "ACTIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:L/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "CWE-352 Cross-Site Request Forgery (CSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "orgId": "00000000-0000-4000-9000-000000000000"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/f82646727"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Cross-Site Request Forgery via Attacker-Controlled REST Detection in MISP",
      "x_gcve": [
        {
          "recordType": "advisory",
          "vulnId": "gcve-1-2026-20213"
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "00000000-0000-4000-9000-000000000000",
    "cveId": "CVE-2026-85547",
    "datePublished": "2026-09-04T09:40:40.324304Z",
    "dateReserved": "2026-09-04T09:40:50.773Z",
    "dateUpdated": "2026-09-04T09:40:51.160348Z",
    "requesterUserId": "00000000-0000-4000-9000-000000000000",
    "serial": 1,
    "state": "PUBLISHED",
    "vulnId": "gcve-1-2026-20213"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}