CWE-352

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "misp",
          "repo": "https://github.com/MISP/MISP/",
          "vendor": "misp",
          "versions": [
            {
              "lessThanOrEqual": "2.5.45",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Andras Iklody"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Scottish Government - National Cyber Team"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Peter James"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eA cross-site request forgery (CSRF) vulnerability exists in MISP due to form-security and CSRF protections being disabled based on whether an incoming request was identified as a REST request.\u003c/p\u003e\u003cp\u003eMISP\u0027s REST detection can be influenced by request properties such as the URL suffix or the HTTP \u003ccode\u003eAccept\u003c/code\u003e header. Because \u003ccode\u003eAccept: application/json\u003c/code\u003e can be supplied by a cross-origin page without requiring a CORS preflight, an attacker could cause a request originating from another website to be treated as REST traffic. MISP would consequently disable its normal form-security and CSRF validation even though the request was authenticated using the victim\u0027s existing browser session.\u003c/p\u003e\u003cp\u003eAn unauthenticated remote attacker could exploit this behavior by convincing an authenticated MISP user to visit or interact with a malicious web page. The attacker\u0027s page could then issue crafted requests to susceptible state-changing MISP endpoints using the victim\u0027s privileges. Depending on the permissions of the victim and the targeted endpoint, this could allow unauthorized modification, creation, publication, or removal of data and other state changes.\u003c/p\u003e\u003cp\u003eThe vulnerability originates from granting the form-security exemption based on \u003ccode\u003e_isRest()\u003c/code\u003e rather than on the authentication mechanism used by the request. The patch changes this behavior so that CSRF and form-security exemptions are granted only when the request actually carries a MISP API key. Session-authenticated REST-style requests remain subject to CSRF protection.\u003cbr\u003eThe fix also introduces support for transmitting CSRF tokens through the \u003ccode\u003eX-CSRF-Token\u003c/code\u003e header for legitimate same-origin AJAX requests. Such a header cannot normally be attached by a cross-origin page without triggering a CORS preflight, preventing it from being used to reproduce the original attack.\u003c/p\u003e\u003cbr\u003e"
            }
          ],
          "value": "A cross-site request forgery (CSRF) vulnerability exists in MISP due to form-security and CSRF protections being disabled based on whether an incoming request was identified as a REST request.\n\nMISP\u0027s REST detection can be influenced by request properties such as the URL suffix or the HTTP Accept header. Because Accept: application/json can be supplied by a cross-origin page without requiring a CORS preflight, an attacker could cause a request originating from another website to be treated as REST traffic. MISP would consequently disable its normal form-security and CSRF validation even though the request was authenticated using the victim\u0027s existing browser session.\n\nAn unauthenticated remote attacker could exploit this behavior by convincing an authenticated MISP user to visit or interact with a malicious web page. The attacker\u0027s page could then issue crafted requests to susceptible state-changing MISP endpoints using the victim\u0027s privileges. Depending on the permissions of the victim and the targeted endpoint, this could allow unauthorized modification, creation, publication, or removal of data and other state changes.\n\nThe vulnerability originates from granting the form-security exemption based on _isRest() rather than on the authentication mechanism used by the request. The patch changes this behavior so that CSRF and form-security exemptions are granted only when the request actually carries a MISP API key. Session-authenticated REST-style requests remain subject to CSRF protection.\nThe fix also introduces support for transmitting CSRF tokens through the X-CSRF-Token header for legitimate same-origin AJAX requests. Such a header cannot normally be attached by a cross-origin page without triggering a CORS preflight, preventing it from being used to reproduce the original attack."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-62",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-62 Cross Site Request Forgery"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.2,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "LOW",
            "userInteraction": "ACTIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:L/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "CWE-352 Cross-Site Request Forgery (CSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "orgId": "00000000-0000-4000-9000-000000000000"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/f82646727"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Cross-Site Request Forgery via Attacker-Controlled REST Detection in MISP",
      "x_gcve": [
        {
          "recordType": "advisory",
          "vulnId": "gcve-1-2026-20213"
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "00000000-0000-4000-9000-000000000000",
    "cveId": "CVE-2026-85547",
    "datePublished": "2026-09-04T09:40:40.324304Z",
    "dateReserved": "2026-09-04T09:40:50.773Z",
    "dateUpdated": "2026-09-04T09:40:51.160348Z",
    "requesterUserId": "00000000-0000-4000-9000-000000000000",
    "serial": 1,
    "state": "PUBLISHED",
    "vulnId": "gcve-1-2026-20213"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "cti-transmute",
          "repo": "https://github.com/MISP/cti-transmute",
          "vendor": "MISP",
          "versions": [
            {
              "lessThanOrEqual": "1.4.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jeroen Pinoy"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Christian Studer"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eAffected versions of MISP cti-transmute expose several state-changing account operations as \u003ccode\u003eGET\u003c/code\u003e requests:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003ccode\u003e/account/follow\u003c/code\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003ccode\u003e/account/delete_notification\u003c/code\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003ccode\u003e/account/mark_notification_read\u003c/code\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003ccode\u003e/account/mark_all_read\u003c/code\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThese endpoints require authentication, but before the fix they could be invoked with simple GET requests. That makes them susceptible to cross-site request forgery because a third-party site can induce the victim\u2019s browser to send authenticated GET requests automatically.\u003c/p\u003e\n\u003cp\u003eThe patch converts the actions to \u003ccode\u003ePOST\u003c/code\u003e or \u003ccode\u003eDELETE\u003c/code\u003e and updates the frontend to include an \u003ccode\u003eX-CSRFToken\u003c/code\u003e header, providing explicit CSRF protection for those state-changing operations.\u003c/p\u003e"
            }
          ],
          "value": "Affected versions of MISP cti-transmute expose several state-changing account operations as GET requests:\n\n\n\n  *  \n/account/follow\n\n\n  *  \n/account/delete_notification\n\n\n  *  \n/account/mark_notification_read\n\n\n  *  \n/account/mark_all_read\n\n\n\n\n\nThese endpoints require authentication, but before the fix they could be invoked with simple GET requests. That makes them susceptible to cross-site request forgery because a third-party site can induce the victim\u2019s browser to send authenticated GET requests automatically.\n\n\nThe patch converts the actions to POST or DELETE and updates the frontend to include an X-CSRFToken header, providing explicit CSRF protection for those state-changing operations."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-62",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-62 Cross Site Request Forgery"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "CWE-352 Cross-Site Request Forgery (CSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "orgId": "00000000-0000-4000-9000-000000000000"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/cti-transmute/commit/c352c2329e48ccc33a2b96d5353450cfbf7e89ec"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "cti-transmute CSRF Allows Unauthorized Follow and Notification State Changes",
      "x_gcve": [
        {
          "recordType": "advisory",
          "vulnId": "gcve-1-2026-20115"
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "00000000-0000-4000-9000-000000000000",
    "cveId": "CVE-2026-73162",
    "datePublished": "2026-08-11T09:13:01.966628Z",
    "dateReserved": "2026-08-11T09:13:12.491Z",
    "dateUpdated": "2026-08-11T09:13:12.572758Z",
    "requesterUserId": "00000000-0000-4000-9000-000000000000",
    "serial": 1,
    "state": "PUBLISHED",
    "vulnId": "gcve-1-2026-20115"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "cti-transmute",
          "repo": "https://github.com/MISP/cti-transmute",
          "vendor": "misp",
          "versions": [
            {
              "lessThanOrEqual": "1.4.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jeroen Pinoy"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Christian Studer"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eCTI-Transmute contained a cross-site request forgery vulnerability in the administrative user deletion functionality. The \u003ccode\u003e/account/delete/\u0026lt;id\u0026gt;\u003c/code\u003e endpoint accepted HTTP GET requests for an operation that modified application state.\u003c/p\u003e\u003cp\u003eAn unauthenticated remote attacker could construct a malicious link or embed a request targeting this endpoint and induce an authenticated CTI-Transmute administrator to visit the attacker-controlled content. If the administrator had an active session, the browser would automatically include the administrator\u2019s session credentials, causing the selected user account to be deleted without the administrator intentionally confirming the operation.\u003c/p\u003e\u003cp\u003eSuccessful exploitation requires interaction from a currently authenticated administrator who has permission to delete users. The attacker does not need a CTI-Transmute account or administrative privileges because the forged request executes using the victim administrator\u2019s session.\u003c/p\u003e\u003cp\u003eThe vulnerability could allow an attacker to delete arbitrary user accounts, resulting in unauthorized modification of application state and denial of access for affected users. Depending on whether administrators can delete other administrators or the final administrative account, exploitation could also disrupt administration of the CTI-Transmute instance.\u003c/p\u003e\u003cp\u003eThe patch resolves the issue by restricting the deletion endpoint to HTTP POST requests and submitting the deletion through a form containing a CSRF token.\u003c/p\u003e"
            }
          ],
          "value": "CTI-Transmute contained a cross-site request forgery vulnerability in the administrative user deletion functionality. The /account/delete/\u003cid\u003e endpoint accepted HTTP GET requests for an operation that modified application state.\n\nAn unauthenticated remote attacker could construct a malicious link or embed a request targeting this endpoint and induce an authenticated CTI-Transmute administrator to visit the attacker-controlled content. If the administrator had an active session, the browser would automatically include the administrator\u2019s session credentials, causing the selected user account to be deleted without the administrator intentionally confirming the operation.\n\nSuccessful exploitation requires interaction from a currently authenticated administrator who has permission to delete users. The attacker does not need a CTI-Transmute account or administrative privileges because the forged request executes using the victim administrator\u2019s session.\n\nThe vulnerability could allow an attacker to delete arbitrary user accounts, resulting in unauthorized modification of application state and denial of access for affected users. Depending on whether administrators can delete other administrators or the final administrative account, exploitation could also disrupt administration of the CTI-Transmute instance.\n\nThe patch resolves the issue by restricting the deletion endpoint to HTTP POST requests and submitting the deletion through a form containing a CSRF token."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-63",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-63 Cross-Site Scripting (XSS)"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "CWE-352 Cross-Site Request Forgery (CSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "orgId": "00000000-0000-4000-9000-000000000000"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/cti-transmute/commit/4f0d051ec5f1d45894c26987d409411728b2d82c"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Cross-Site Request Forgery in the Administrative User Deletion Endpoint",
      "x_gcve": [
        {
          "recordType": "advisory",
          "vulnId": "gcve-1-2026-20111"
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "00000000-0000-4000-9000-000000000000",
    "cveId": "CVE-2026-69082",
    "datePublished": "2026-08-03T09:42:38.748873Z",
    "dateReserved": "2026-08-03T09:42:53.915Z",
    "dateUpdated": "2026-08-03T09:42:53.991511Z",
    "requesterUserId": "00000000-0000-4000-9000-000000000000",
    "serial": 1,
    "state": "PUBLISHED",
    "vulnId": "gcve-1-2026-20111"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "misp",
          "repo": "https://github.com/MISP/MISP",
          "vendor": "misp",
          "versions": [
            {
              "lessThanOrEqual": "2.5.45",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Andras Iklody"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Peter James"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Scottish Government - National Cyber Team"
        },
        {
          "lang": "en",
          "type": "tool",
          "value": "Claude Opus 5 (1M context)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eA cross-site request forgery (CSRF) vulnerability existed in the \u003ccode\u003ecullEmptyEvents\u003c/code\u003e action of MISP. The endpoint performed a state-changing and irreversible operation while accepting HTTP GET requests.\u003c/p\u003e\n\u003cp\u003eBecause bodyless GET requests are not subject to CakePHP\u0027s CSRF validation, an attacker could cause an authenticated MISP user with sufficient privileges to invoke the endpoint simply by causing their browser to load a crafted URL, for example through an embedded image or other automatically requested resource.\u003c/p\u003e\n\u003cp\u003eSuccessful exploitation triggers the deletion of published empty events. The deletion is particularly significant because the operation uses \u003ccode\u003eskipBlocklist\u003c/code\u003e, meaning the removed events do not leave blocklist entries that could prevent or track their subsequent synchronization. This can result in unintended and potentially irreversible deletion of MISP event records without explicit user interaction.\u003c/p\u003e\n\u003cp\u003eThe vulnerability was addressed by restricting \u003ccode\u003ecullEmptyEvents\u003c/code\u003e to HTTP POST requests, ensuring that CakePHP\u0027s normal CSRF protections are applied to the operation.\u003c/p\u003e\u003cbr\u003e"
            }
          ],
          "value": "A cross-site request forgery (CSRF) vulnerability existed in the cullEmptyEvents action of MISP. The endpoint performed a state-changing and irreversible operation while accepting HTTP GET requests.\n\n\nBecause bodyless GET requests are not subject to CakePHP\u0027s CSRF validation, an attacker could cause an authenticated MISP user with sufficient privileges to invoke the endpoint simply by causing their browser to load a crafted URL, for example through an embedded image or other automatically requested resource.\n\n\nSuccessful exploitation triggers the deletion of published empty events. The deletion is particularly significant because the operation uses skipBlocklist, meaning the removed events do not leave blocklist entries that could prevent or track their subsequent synchronization. This can result in unintended and potentially irreversible deletion of MISP event records without explicit user interaction.\n\n\nThe vulnerability was addressed by restricting cullEmptyEvents to HTTP POST requests, ensuring that CakePHP\u0027s normal CSRF protections are applied to the operation."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-62",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-62 Cross Site Request Forgery"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "CWE-352 Cross-Site Request Forgery (CSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "orgId": "00000000-0000-4000-9000-000000000000"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/2b6b3ac90"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/50106c9a0"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/66ecb5acb"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/9c1346ce1"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/cfc8b8a6d"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "MISP cullEmptyEvents CSRF Allows Irreversible Deletion of Events via GET Request",
      "x_gcve": [
        {
          "recordType": "advisory",
          "vulnId": "gcve-1-2026-20104"
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "00000000-0000-4000-9000-000000000000",
    "cveId": "CVE-2026-85236",
    "datePublished": "2026-09-03T15:12:44.713069Z",
    "dateReserved": "2026-09-03T15:12:56.306Z",
    "dateUpdated": "2026-09-03T15:12:56.376460Z",
    "requesterUserId": "00000000-0000-4000-9000-000000000000",
    "serial": 1,
    "state": "PUBLISHED",
    "vulnId": "gcve-1-2026-20104"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "modules": [
            "app/Controller/Component/BetterSecurityComponent.php"
          ],
          "product": "MISP",
          "programFiles": [
            "app/Controller/Component/BetterSecurityComponent.php"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.46",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 5 (1M context)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e\u003c/p\u003e\u003cp\u003eAffected versions of MISP rely on CakePHP request-method override processing in a way that can disable CSRF and form-security validation.\u003c/p\u003e\u003cp\u003eCakePHP honors a \u003ccode\u003e_method\u003c/code\u003e field or \u003ccode\u003eX-HTTP-Method-Override\u003c/code\u003e header by rewriting the effective request method. For override values outside the normal write verbs \u003ccode\u003ePOST\u003c/code\u003e, \u003ccode\u003ePUT\u003c/code\u003e, \u003ccode\u003ePATCH\u003c/code\u003e, and \u003ccode\u003eDELETE\u003c/code\u003e, CakePHP also clears the parsed request body. MISP\u2019s security component then determines whether to perform \u003ccode\u003e_validatePost()\u003c/code\u003e and \u003ccode\u003e_validateCsrf()\u003c/code\u003e based on whether request data remains. With a value such as:\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003e_method=GET\u003c/code\u003e\u003c/p\u003e\u003cp\u003ethe body becomes empty before those checks run, so both protections are skipped. A cross-site form containing only that override can therefore reach actions whose parameters are taken from the URL rather than the request body\u003c/p\u003e\u003cp\u003eVersion affected: \u22642.5.45\u003cbr\u003e\u003c/p\u003e"
            }
          ],
          "value": "Affected versions of MISP rely on CakePHP request-method override processing in a way that can disable CSRF and form-security validation.\n\nCakePHP honors a _method field or X-HTTP-Method-Override header by rewriting the effective request method. For override values outside the normal write verbs POST, PUT, PATCH, and DELETE, CakePHP also clears the parsed request body. MISP\u2019s security component then determines whether to perform _validatePost() and _validateCsrf() based on whether request data remains. With a value such as:\n\n\n_method=GET\n\nthe body becomes empty before those checks run, so both protections are skipped. A cross-site form containing only that override can therefore reach actions whose parameters are taken from the URL rather than the request body\n\nVersion affected: \u22642.5.45"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-62",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-62 Cross Site Request Forgery"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "CWE-352 Cross-Site Request Forgery (CSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20 Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "orgId": "00000000-0000-4000-9000-000000000000"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/29af008c4"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe fix introduces a __rejectUnsafeMethodOverride() check in BetterSecurityComponent::startup() that executes before the parent SecurityComponent::startup() computes $hasData. It inspects both the _method POST field and the X-HTTP-Method-Override header (mirroring CakePHP\u0027s precedence) and rejects any value that is not a string in the allowed set {POST, PUT, PATCH, DELETE}. Non-string values (e.g., array payloads like _method[]=GET) are also refused. A BadRequestException is thrown and the event is logged, preventing the request from ever reaching the parent security logic with an emptied body.\u003c/p\u003e"
            }
          ],
          "value": "The fix introduces a __rejectUnsafeMethodOverride() check in BetterSecurityComponent::startup() that executes before the parent SecurityComponent::startup() computes $hasData. It inspects both the _method POST field and the X-HTTP-Method-Override header (mirroring CakePHP\u0027s precedence) and rejects any value that is not a string in the allowed set {POST, PUT, PATCH, DELETE}. Non-string values (e.g., array payloads like _method[]=GET) are also refused. A BadRequestException is thrown and the event is logged, preventing the request from ever reaching the parent security logic with an emptied body."
        }
      ],
      "title": "MISP: HTTP Method Override Bypasses CSRF and Form Validation in BetterSecurityComponent",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "review",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The fix is included in MISP v2.5.46 based on the tag_version_boundary metadata (228 commits after the fix commit at that tag); the exact affected version range prior to the fix is not explicitly stated in the patch.",
                  "PR:L assumes the victim must be an authenticated MISP user; the patch does not explicitly state authentication requirements, but MISP is an authenticated threat-intelligence platform and the example endpoint (/feeds/enable/2) implies an authenticated context.",
                  "UI:P assumes the typical CSRF delivery mechanism (auto-submitting form on a malicious page) where the victim\u0027s interaction is limited to loading the page; if a manual form submission is required, UI:A would be more appropriate.",
                  "The vulnerability was found during internal review and was not externally reported, per the commit message."
                ],
                "commit": "29af008c47d2cc021b6183a0f119b36c8eabfe65",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 5 (1M context)"
                  }
                ],
                "cvssRationale": "AV:N: The attack is delivered over the network via a crafted HTML form or HTTP header. AC:L: Exploitation requires only crafting a form with a _method field; no race conditions or complex timing are needed. AT:N: No manipulation of the target\u0027s data or state is required prior to the attack. PR:L: The victim must be an authenticated MISP user; no administrative privileges are needed. UI:P: The victim passively interacts with the attack (e.g., visiting a page with an auto-submitting form); no deliberate action beyond page load is required. VC:N: No confidentiality impact is evident from the patch evidence. VI:H: The attacker can perform arbitrary state-changing actions (enable/disable feeds, modify objects) on the victim\u0027s MISP instance, representing high integrity impact. VA:N: No availability impact is indicated. SC/SI/SA:N: No sub-component impact is evidenced.",
                "draft": false,
                "fixSummary": "The fix introduces a __rejectUnsafeMethodOverride() check in BetterSecurityComponent::startup() that executes before the parent SecurityComponent::startup() computes $hasData. It inspects both the _method POST field and the X-HTTP-Method-Override header (mirroring CakePHP\u0027s precedence) and rejects any value that is not a string in the allowed set {POST, PUT, PATCH, DELETE}. Non-string values (e.g., array payloads like _method[]=GET) are also refused. A BadRequestException is thrown and the event is logged, preventing the request from ever reaching the parent security logic with an emptied body.",
                "generatedAt": "2026-09-15T07:32:05.818714Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 9,
                      "assumptionCount": 4,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 6
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "97161c8af5472e6169868d916a2e4834f382a4e1f7c8efda555ea396171b8d3a",
                "patchSummary": "Adds a private __rejectUnsafeMethodOverride() method and a public startup() override to BetterSecurityComponent. The new method reads $_POST[\u0027_method\u0027] and the HTTP_X_HTTP_METHOD_OVERRIDE header, applies the same header-over-body precedence as CakeRequest::_processPost(), and throws BadRequestException for any override that is not a string in the ALLOWED_METHOD_OVERRIDES constant (POST, PUT, PATCH, DELETE). The startup() override calls this check before delegating to parent::startup(). A new test file BetterSecurityComponentTest.php (196 lines) covers pass-through of write verbs, refusal of non-write verbs, non-string overrides, header overrides, header-over-body precedence, and log output.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "29af008c47d2cc021b6183a0f119b36c8eabfe65",
                    "patchSha256": "97161c8af5472e6169868d916a2e4834f382a4e1f7c8efda555ea396171b8d3a",
                    "source": "https://github.com/MISP/MISP/commit/29af008c4.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/29af008c4.patch",
                    "subject": "fix: [security] Refuse HTTP method overrides that empty the"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/29af008c4.patch",
                "subject": "fix: [security] Refuse HTTP method overrides that empty the",
                "tagVersionBoundary": {
                  "commits_after_fix": 228,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.46",
                  "version": "2.5.46",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-352",
                    "rationale": "The primary security impact is the complete bypass of CSRF token validation. An attacker can forge requests to state-changing MISP endpoints without a valid CSRF token by exploiting the method-override body-emptying behaviour."
                  },
                  {
                    "cweId": "CWE-20",
                    "rationale": "The root cause is the failure to validate the _method override value before it influences the security component\u0027s behaviour. Any verb outside the expected write set is accepted by the framework and causes the request body to be discarded, disabling security checks."
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20102"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "00000000-0000-4000-9000-000000000000",
    "cveId": "CVE-2026-91819",
    "datePublished": "2026-09-15T07:41:19.838478Z",
    "dateReserved": "2026-09-15T07:41:29.630Z",
    "dateUpdated": "2026-09-15T07:41:29.964690Z",
    "state": "PUBLISHED",
    "vulnId": "gcve-1-2026-20102"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "misp",
          "repo": "https://github.com/MISP/MISP",
          "vendor": "misp",
          "versions": [
            {
              "lessThan": "2.5.39",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Andras Iklody"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Jos\u00e9 Pedro Mo\u00e7o"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMISP instances with the \u003ccode\u003eSecurity.check_sec_fetch_site_header\u003c/code\u003e setting disabled may be exposed to cross-site request forgery attacks against state-changing endpoints, including automation endpoints. A remote unauthenticated attacker could craft a malicious web page or link that causes the browser of an authenticated MISP user to issue POST, PUT, or AJAX requests to the affected instance. If accepted by the application, those requests may be processed with the privileges of the victim user.\u003c/p\u003e\u003cp\u003eThis issue is configuration-dependent. The upstream change introduces an administrative security warning for instances where \u003ccode\u003eSecurity.check_sec_fetch_site_header\u003c/code\u003e is not enabled. Enabling this setting is recommended because it restricts relevant requests to cases where the \u003ccode\u003eSec-Fetch-Site\u003c/code\u003e header is absent or indicates \u003ccode\u003esame-origin\u003c/code\u003e. Operators of multi-homed instances should test before enabling, as this protection may interfere with deployments that are accessed through multiple hostnames or addresses.\u003c/p\u003e\u003cp\u003eAffected configuration:\u003cbr\u003e\u003ccode\u003eSecurity.check_sec_fetch_site_header = false\u003c/code\u003e\u003c/p\u003e\u003cp\u003eRecommended mitigation:\u003cbr\u003eEnable \u003ccode\u003eSecurity.check_sec_fetch_site_header\u003c/code\u003e where compatible with the deployment, and validate legitimate workflows on instances served under multiple hostnames.\u003c/p\u003e\u003cbr\u003e"
            }
          ],
          "value": "MISP instances with the Security.check_sec_fetch_site_header setting disabled may be exposed to cross-site request forgery attacks against state-changing endpoints, including automation endpoints. A remote unauthenticated attacker could craft a malicious web page or link that causes the browser of an authenticated MISP user to issue POST, PUT, or AJAX requests to the affected instance. If accepted by the application, those requests may be processed with the privileges of the victim user.\n\nThis issue is configuration-dependent. The upstream change introduces an administrative security warning for instances where Security.check_sec_fetch_site_header is not enabled. Enabling this setting is recommended because it restricts relevant requests to cases where the Sec-Fetch-Site header is absent or indicates same-origin. Operators of multi-homed instances should test before enabling, as this protection may interfere with deployments that are accessed through multiple hostnames or addresses.\n\nAffected configuration:\nSecurity.check_sec_fetch_site_header = false\n\nRecommended mitigation:\nEnable Security.check_sec_fetch_site_header where compatible with the deployment, and validate legitimate workflows on instances served under multiple hostnames."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-62",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-62 Cross Site Request Forgery"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NO",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "providerUrgency": "CLEAR",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/AU:N/U:Clear",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "CWE-352 Cross-Site Request Forgery (CSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "orgId": "00000000-0000-4000-9000-000000000000"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/b82db1bcaa550689c05e1ed175e81f25a8d97b91"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "MISP may be exposed to CSRF attacks when Sec-Fetch-Site enforcement is disabled",
      "x_gcve": [
        {
          "recordType": "advisory",
          "vulnId": "gcve-1-2026-20046"
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "00000000-0000-4000-9000-000000000000",
    "datePublished": "2026-06-11T13:07:22.129989Z",
    "dateUpdated": "2026-06-11T13:08:27.777574Z",
    "requesterUserId": "00000000-0000-4000-9000-000000000000",
    "serial": 1,
    "state": "PUBLISHED",
    "vulnId": "gcve-1-2026-20046"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "modules": [
            "AttributesController"
          ],
          "product": "MISP",
          "programFiles": [
            "app/Controller/AttributesController.php"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.47",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Jeroen Pinoy"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 5 (1M context)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMISP has a security issue that could let an attacker change threat-intelligence data through a logged-in user\u2019s browser without that user knowingly approving the change.\u003c/p\u003e\u003cp\u003eThe affected function did not properly enforce MISP\u2019s usual protection against forged requests. Because of this, an attacker could create a malicious webpage that silently sends a request to MISP when visited by an authenticated user.\u003c/p\u003e\u003cp\u003eIf successful, the attacker could change details of an attribute, such as its value, type, category, comment, distribution settings, or related timestamps.\u003c/p\u003e\u003cp\u003eThe attack requires the victim to already be logged in to MISP and to visit an attacker-controlled page.\u003c/p\u003e\u003cp\u003eThe main impact is unauthorized modification of threat-intelligence data, which could lead to incorrect indicators, wrong classifications, or altered sharing settings and reduce confidence in the accuracy of the information stored in MISP.\u003c/p\u003eVersion affected: \u0026lt;2.5.47"
            }
          ],
          "value": "MISP has a security issue that could let an attacker change threat-intelligence data through a logged-in user\u2019s browser without that user knowingly approving the change.\n\nThe affected function did not properly enforce MISP\u2019s usual protection against forged requests. Because of this, an attacker could create a malicious webpage that silently sends a request to MISP when visited by an authenticated user.\n\nIf successful, the attacker could change details of an attribute, such as its value, type, category, comment, distribution settings, or related timestamps.\n\nThe attack requires the victim to already be logged in to MISP and to visit an attacker-controlled page.\n\nThe main impact is unauthorized modification of threat-intelligence data, which could lead to incorrect indicators, wrong classifications, or altered sharing settings and reduce confidence in the accuracy of the information stored in MISP.\n\nVersion affected: \u003c2.5.47"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-124",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-124 Cross-Site Request Forgery"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "CWE-352 Cross-Site Request Forgery (CSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "orgId": "00000000-0000-4000-9000-000000000000"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/dfbae33f9"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe editField action is removed from the Security component\u0027s unlockedActions list and added to the _csrfTokenHeaderOnly array. This enforces CSRF token validation (accepted either in the X-CSRF-Token header or in the request body) while dropping only the field-hash check, which the existing AJAX callers (Overmind index and legacy inline forms) cannot satisfy. Legitimate callers are unaffected because they already transmit a valid CSRF token.\u003c/p\u003e"
            }
          ],
          "value": "The editField action is removed from the Security component\u0027s unlockedActions list and added to the _csrfTokenHeaderOnly array. This enforces CSRF token validation (accepted either in the X-CSRF-Token header or in the request body) while dropping only the field-hash check, which the existing AJAX callers (Overmind index and legacy inline forms) cannot satisfy. Legitimate callers are unaffected because they already transmit a valid CSRF token."
        }
      ],
      "title": "MISP CSRF vulnerability allows unauthorized attribute modification",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "review",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The affected version range is inferred from the tag_version_boundary (v2.5.47 with 7 commits after the fix); no explicit \u0027affected\u0027 or \u0027fixed\u0027 version strings are provided in the metadata, so the exact version boundary is approximate.",
                  "UI:P (Passive) is assumed because the commit message describes a \u0027cross-site form post\u0027 that auto-submits when the victim\u0027s browser loads the attacker\u0027s page; if the attack requires the victim to explicitly click a link or submit a form, UI:A would be more appropriate.",
                  "PR:N is assumed because the attacker does not need their own MISP account; the victim\u0027s authenticated session cookie is sufficient. If MISP deployments require additional authentication factors (e.g., MFA) that would block a cross-site form post, the effective exploitability may be lower.",
                  "The CAPEC-124 mapping is the closest standard pattern for CSRF; no more specific CAPEC exists for the CakePHP unlockedActions bypass mechanism.",
                  "The Co-Authored-By AI tool is included as a \u0027tool\u0027 credit based on explicit commit metadata; it is not a human contributor."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-124",
                    "rationale": "The patch description explicitly states that a cross-site form post carrying the victim\u0027s session cookie could rewrite attribute fields. This is the canonical CSRF attack pattern: an attacker induces a victim\u0027s browser to send an authenticated request to a target application without the victim\u0027s knowledge or consent. CAPEC-124 is the most direct and specific match."
                  }
                ],
                "commit": "dfbae33f9a93bf127fae115bc6cd1a9e03d028e9",
                "confidence": "high",
                "credits": [
                  {
                    "lang": "en",
                    "type": "reporter",
                    "value": "Jeroen Pinoy"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 5 (1M context)"
                  }
                ],
                "cvssRationale": "AV:N: The attack is delivered over the network via a malicious web page. AC:L: Crafting a CSRF form is straightforward and requires no race conditions or special timing. AT:N: The target MISP instance is not under the attacker\u0027s control. PR:N: The attacker needs no account on MISP; the victim\u0027s existing session is sufficient. UI:P: The victim must passively load the attacker\u0027s page (e.g., visit a link), which triggers the auto-submitting form; no explicit click or form submission by the victim is required. VC:N: The attack modifies data but does not disclose confidential information. VI:H: The attacker can alter attribute values, types, categories, distribution, and timestamps, corrupting threat-intelligence data for all users. VA:N: No denial-of-service impact is indicated. SC/SI/SA:N: No secondary impacts on other systems are evidenced.",
                "fixSummary": "The editField action is removed from the Security component\u0027s unlockedActions list and added to the _csrfTokenHeaderOnly array. This enforces CSRF token validation (accepted either in the X-CSRF-Token header or in the request body) while dropping only the field-hash check, which the existing AJAX callers (Overmind index and legacy inline forms) cannot satisfy. Legitimate callers are unaffected because they already transmit a valid CSRF token.",
                "generatedAt": "2026-09-21T13:38:54.473662Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 9,
                      "assumptionCount": 5,
                      "confidence": "high",
                      "model": "qwen3.8:27b",
                      "score": 6
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "beb65b8daaa1d2e649f1178cc7f2c774f4ba7e75a13cc000524eef566c4545c8",
                "patchSummary": "In app/Controller/AttributesController.php, the string \u0027editField\u0027 is added to the _csrfTokenHeaderOnly() call in beforeFilter(), enabling header-or-body CSRF token validation for that action. Simultaneously, the line adding \u0027editField\u0027 to $this-\u003eSecurity-\u003eunlockedActions[] is removed, so the action is no longer exempt from CSRF checks. A comment block is added explaining that both the Overmind index (token in X-CSRF-Token header) and legacy inline forms (token in body) already carry a valid token, so only the unsatisfiable field-hash check is dropped.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "dfbae33f9a93bf127fae115bc6cd1a9e03d028e9",
                    "patchSha256": "beb65b8daaa1d2e649f1178cc7f2c774f4ba7e75a13cc000524eef566c4545c8",
                    "source": "https://github.com/MISP/MISP/commit/dfbae33f9.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/dfbae33f9.patch",
                    "subject": "fix: [security] Keep the CSRF check on the inline attribute"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/dfbae33f9.patch",
                "subject": "fix: [security] Keep the CSRF check on the inline attribute",
                "tagVersionBoundary": {
                  "commits_after_fix": 7,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.47",
                  "version": "2.5.47",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-352",
                    "rationale": "The editField action was placed in unlockedActions, which explicitly bypassed the CSRF token check. This allowed a cross-site form post to modify attribute data using only the victim\u0027s session cookie, a textbook CSRF weakness."
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20043"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "00000000-0000-4000-9000-000000000000",
    "cveId": "CVE-2026-94404",
    "datePublished": "2026-09-21T13:50:37.643790Z",
    "dateReserved": "2026-09-21T13:50:44.676Z",
    "dateUpdated": "2026-09-21T13:50:44.744216Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1-2026-20043"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "misp",
          "repo": "https://github.com/misp/misp",
          "vendor": "misp",
          "versions": [
            {
              "lessThan": "2.5.40",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jos\u00e9 Pedro Mo\u00e7o"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Andras Iklody"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "MISP contains an insecure default configuration in which the \u003ccode\u003eSecurity.check_sec_fetch_site_header\u003c/code\u003e control is disabled. When this setting is disabled, state-changing requests such as POST, PUT, or AJAX requests are not restricted based on the browser-provided \u003ccode\u003eSec-Fetch-Site\u003c/code\u003e header. A remote unauthenticated attacker could craft a malicious web page that causes an authenticated MISP user\u2019s browser to issue cross-site requests to MISP automation endpoints. If successful, the forged requests may be processed with the privileges of the victim user, potentially allowing unauthorized modification of MISP data or configuration. Enabling \u003ccode\u003eSecurity.check_sec_fetch_site_header\u003c/code\u003e mitigates this issue, although operators of multi-homed MISP deployments should validate the setting before enforcing it."
            }
          ],
          "value": "MISP contains an insecure default configuration in which the Security.check_sec_fetch_site_header control is disabled. When this setting is disabled, state-changing requests such as POST, PUT, or AJAX requests are not restricted based on the browser-provided Sec-Fetch-Site header. A remote unauthenticated attacker could craft a malicious web page that causes an authenticated MISP user\u2019s browser to issue cross-site requests to MISP automation endpoints. If successful, the forged requests may be processed with the privileges of the victim user, potentially allowing unauthorized modification of MISP data or configuration. Enabling Security.check_sec_fetch_site_header mitigates this issue, although operators of multi-homed MISP deployments should validate the setting before enforcing it."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-62",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-62 Cross Site Request Forgery"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "LOW",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "CWE-352 Cross-Site Request Forgery (CSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-1188",
              "description": "CWE-1188 Insecure Default Initialization of Resource",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "orgId": "00000000-0000-4000-9000-000000000000"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/b82db1bcaa550689c05e1ed175e81f25a8d97b91"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "MISP automation endpoints may be exposed to CSRF when Sec-Fetch-Site protection is disabled by default",
      "x_gcve": [
        {
          "recordType": "advisory",
          "vulnId": "gcve-1-2026-20040"
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "00000000-0000-4000-9000-000000000000",
    "cveId": "CVE-2026-54359",
    "datePublished": "2026-06-12T19:44:03.403919Z",
    "dateReserved": "2026-06-12T19:44:13.149Z",
    "dateUpdated": "2026-06-12T19:44:13.229452Z",
    "requesterUserId": "00000000-0000-4000-9000-000000000000",
    "serial": 1,
    "state": "PUBLISHED",
    "vulnId": "gcve-1-2026-20040"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-19786",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-14T14:12:46.292487Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-14T14:12:52.285Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/francoisjacquet/rosariosis/issues/302"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:rosariosis:rosariosis:*:*:*:*:*:*:*:*"
          ],
          "product": "RosarioSIS",
          "vendor": "francoisjacquet",
          "versions": [
            {
              "status": "affected",
              "version": "12.0"
            },
            {
              "status": "affected",
              "version": "12.1"
            },
            {
              "status": "affected",
              "version": "12.2"
            },
            {
              "status": "affected",
              "version": "12.3"
            },
            {
              "status": "affected",
              "version": "12.4"
            },
            {
              "status": "affected",
              "version": "12.5"
            },
            {
              "status": "affected",
              "version": "12.6"
            },
            {
              "status": "affected",
              "version": "12.7"
            },
            {
              "status": "affected",
              "version": "12.8"
            },
            {
              "status": "unaffected",
              "version": "12.9"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Mitch311 (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was found in francoisjacquet RosarioSIS up to 12.8. This issue affects some unknown processing of the file Modules.php. Performing a manipulation results in cross-site request forgery. Remote exploitation of the attack is possible. Upgrading to version 12.9 is capable of addressing this issue. The patch is named 801a71272c82cf4bf695fdc5ed42a9b7511d124d. It is recommended to upgrade the affected component."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:X/RL:O/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:X/RL:O/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 5,
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N/E:ND/RL:OF/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "Cross-Site Request Forgery",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-14T02:30:11.223Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-389746 | francoisjacquet RosarioSIS Modules.php cross-site request forgery",
          "tags": [
            "vdb-entry"
          ],
          "url": "https://vuldb.com/vuln/389746"
        },
        {
          "name": "VDB-389746 | CTI Indicators (IOB, IOC, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/389746/cti"
        },
        {
          "name": "CVE-2026-19786 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-19786"
        },
        {
          "name": "Submit #869378 | francoisjacquet RosarioSIS \u003c=v12.8 Cross-Site Request Forgery",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/869378"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/francoisjacquet/rosariosis/issues/302"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/francoisjacquet/RosarioSIS/commit/801a71272c82cf4bf695fdc5ed42a9b7511d124d"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/francoisjacquet/rosariosis/releases/tag/v12.9"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/francoisjacquet/rosariosis/"
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-08-13T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-08-13T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-08-13T20:34:11.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "francoisjacquet RosarioSIS Modules.php cross-site request forgery",
      "x_generator": [
        "VulDB PVTS v202608"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-19786",
    "datePublished": "2026-08-14T02:30:11.223Z",
    "dateReserved": "2026-08-13T18:28:55.822Z",
    "dateUpdated": "2026-08-14T14:12:52.285Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-19650",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-17T20:44:43.807063Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-17T20:44:54.963Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "product": "GitLab",
          "repo": "git://git@gitlab.com:gitlab-org/gitlab.git",
          "vendor": "GitLab",
          "versions": [
            {
              "lessThan": "18.11.11",
              "status": "affected",
              "version": "18.2",
              "versionType": "semver"
            },
            {
              "lessThan": "19.0.8",
              "status": "affected",
              "version": "19.0",
              "versionType": "semver"
            },
            {
              "lessThan": "19.1.6",
              "status": "affected",
              "version": "19.1",
              "versionType": "semver"
            },
            {
              "lessThan": "19.2.4",
              "status": "affected",
              "version": "19.2",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Thanks [kreep](https://hackerone.com/kreep) for reporting this vulnerability through our HackerOne bug bounty program"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could have allowed an unauthenticated user to execute mutations via GET requests due to improper request validation in GraphQL multiplex query handling."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "CWE-352: Cross-Site Request Forgery (CSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T20:04:56.287Z",
        "orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
        "shortName": "GitLab"
      },
      "references": [
        {
          "url": "https://gitlab.com/gitlab-org/gitlab/-/work_items/612617"
        },
        {
          "name": "HackerOne Bug Bounty Report #3903669",
          "tags": [
            "technical-description",
            "exploit",
            "permissions-required"
          ],
          "url": "https://hackerone.com/reports/3903669"
        },
        {
          "url": "https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-2-4-released/"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade to versions 18.11.11, 19.0.8, 19.1.6, 19.2.4 or above."
        }
      ],
      "title": "Cross-Site Request Forgery (CSRF) in GitLab"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
    "assignerShortName": "GitLab",
    "cveId": "CVE-2026-19650",
    "datePublished": "2026-08-17T20:04:56.287Z",
    "dateReserved": "2026-08-12T17:34:46.769Z",
    "dateUpdated": "2026-08-17T20:44:54.963Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}