CVE-2026-73162: cti-transmute CSRF Allows Unauthorized Follow and Notification State Changes
Affected versions of MISP cti-transmute expose several state-changing account operations as GET requests:
/account/follow
/account/deletenotification
/account/marknotificationread
/account/markallread
These endpoints require authentication, but before the fix they could be invoked with simple GET requests. That makes them susceptible to cross-site request forgery because a third-party site can induce the victim’s browser to send authenticated GET requests automatically.
The patch converts the actions to POST or DELETE and updates the frontend to include an X-CSRFToken header, providing explicit CSRF protection for those state-changing operations.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
As a compensating control, ensure that only CSRF-protected POST/DELETE requests are accepted for these endpoints; reject/disable GET handling for /account/delete_notification, /account/follow, /account/mark_all_read, and /account/mark_notification_read to prevent CSRF via authenticated GET requests.