CVE-2026-73162: cti-transmute CSRF Allows Unauthorized Follow and Notification State Changes
Affected versions of MISP cti-transmute expose several state-changing account operations as GET requests:
/account/follow
/account/deletenotification
/account/marknotificationread
/account/markallread
These endpoints require authentication, but before the fix they could be invoked with simple GET requests. That makes them susceptible to cross-site request forgery because a third-party site can induce the victim’s browser to send authenticated GET requests automatically.
The patch converts the actions to POST or DELETE and updates the frontend to include an X-CSRFToken header, providing explicit CSRF protection for those state-changing operations.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
As a compensating control, ensure that only CSRF-protected POST/DELETE requests are accepted for these endpoints; reject/disable GET handling for /account/delete_notification, /account/follow, /account/mark_all_read, and /account/mark_notification_read to prevent CSRF via authenticated GET requests.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73162?
CVE-2026-73162 has a risk rating of 32, indicating a significant vulnerability.
How do I fix CVE-2026-73162?
To resolve CVE-2026-73162, update to the latest version of MISP cti-transmute where the issue is patched.
What specific vulnerabilities does CVE-2026-73162 address?
CVE-2026-73162 addresses improper handling of state-changing operations that can be invoked via CSRF.
Which operations are affected by CVE-2026-73162?
CVE-2026-73162 affects the operations for following accounts and managing notifications within the MISP cti-transmute.
Is authentication sufficient to safeguard against CVE-2026-73162?
No, CVE-2026-73162 demonstrates that authentication alone was inadequate due to the CSRF vulnerability.