https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 13:02:56 +0000 https://vulnerability.circl.lu/vuln/cve-2026-73162 <p><strong>Affected:</strong> MISP cti-transmute</p> <p>Affected versions of MISP cti-transmute expose several state-changing account operations as GET requests:</p> <p>* /account/follow</p> <p>* /account/delete_notification</p> <p>* /account/mark_notification_read</p> <p>* /account/mark_all_read</p> <p>These endpoints require authentication, but before the fix they could be invoked with simple GET requests. That makes them susceptible to cross-site request forgery because a third-party site can induce the victim’s browser to send authenticated GET requests automatically.</p> <p>The patch converts the actions to POST or DELETE and updates the frontend to include an X-CSRFToken header, providing explicit CSRF protection for those state-changing operations.</p> <p><strong>Affected:</strong> MISP cti-transmute</p> <p>Affected versions of MISP cti-transmute expose several state-changing account operations as GET requests:</p> <p>* /account/follow</p> <p>* /account/delete_notification</p> <p>* /account/mark_notification_read</p> <p>* /account/mark_all_read</p> <p>These endpoints require authentication, but before the fix they could be invoked with simple GET requests. That makes them susceptible to cross-site request forgery because a third-party site can induce the victim’s browser to send authenticated GET requests automatically.</p> <p>The patch converts the actions to POST or DELETE and updates the frontend to include an X-CSRFToken header, providing explicit CSRF protection for those state-changing operations.</p> https://vulnerability.circl.lu/vuln/cve-2026-73162