CVE-2026-85236: MISP cullEmptyEvents CSRF Allows Irreversible Deletion of Events via GET Request
A cross-site request forgery (CSRF) vulnerability existed in the cullEmptyEvents action of MISP. The endpoint performed a state-changing and irreversible operation while accepting HTTP GET requests.
Because bodyless GET requests are not subject to CakePHP's CSRF validation, an attacker could cause an authenticated MISP user with sufficient privileges to invoke the endpoint simply by causing their browser to load a crafted URL, for example through an embedded image or other automatically requested resource.
Successful exploitation triggers the deletion of published empty events. The deletion is particularly significant because the operation uses skipBlocklist, meaning the removed events do not leave blocklist entries that could prevent or track their subsequent synchronization. This can result in unintended and potentially irreversible deletion of MISP event records without explicit user interaction.
The vulnerability was addressed by restricting cullEmptyEvents to HTTP POST requests, ensuring that CakePHP's normal CSRF protections are applied to the operation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Restrict the MISP cullEmptyEvents endpoint/action to HTTP POST only, so CakePHP CSRF validation applies; do not allow bodyless GET requests to invoke the state-changing, irreversible deletion.
MISP (cullEmptyEvents action) HTTP method restriction = Restrict to POST (deny GET)
Event History
Frequently Asked Questions
Which users are exposed to exploitation?
An authenticated MISP user must have sufficient privileges to invoke the cullEmptyEvents action. An attacker can then trigger the request by causing that user's browser to load a crafted URL, including through an embedded image or another automatically requested resource.
What records can be deleted if exploitation succeeds?
The action deletes published empty events. The operation uses skipBlocklist, so deleted events do not create blocklist entries that could prevent or track later synchronization.
What change addresses the issue?
The affected action was restricted to HTTP POST requests. This causes CakePHP's normal CSRF protections to apply to the state-changing operation.