CVE-2026-85546: MISP Sharing Group Quick-Edit Actions Allow CSRF via State-Changing GET Requests
MISP contains a cross-site request forgery (CSRF) vulnerability in the sharing group quick-edit functionality. The addOrg, removeOrg, addServer, and removeServer actions share the initialiseSGQuickEdit() helper, where the HTTP method validation intended to restrict these operations to POST requests was commented out.
As a result, these state-changing actions could be invoked using GET requests. An attacker could craft a URL targeting one of the affected actions and cause an authenticated MISP user with sufficient privileges to request it, for example through a malicious link or embedded web resource.
Successful exploitation could modify the membership of a MISP sharing group without the victim intentionally performing the operation. Depending on the action performed, an attacker could add or remove organisations or servers from a sharing group, potentially granting unintended access to information distributed through that sharing group or disrupting legitimate information sharing.
The patch restores HTTP method enforcement centrally in initialiseSGQuickEdit() by calling allowMethod(['post']), ensuring that all four affected quick-edit operations require POST requests and are therefore subject to the application's normal protections for state-changing requests.
Affected Software
Event History
Frequently Asked Questions
Who can be targeted, and what privileges must they have?
An attacker must induce an authenticated MISP user with sufficient privileges to access a sharing group quick-edit action. The impact is limited to changes that the targeted user's permissions allow.
Which sharing group changes could an attacker trigger?
The affected quick-edit actions are addOrg, removeOrg, addServer, and removeServer. Exploitation could add or remove organisations or servers from a sharing group.
What conditions are needed for exploitation?
The attacker needs to cause the authenticated user to request a crafted URL, such as through a malicious link or embedded web resource. Because the affected actions accepted GET requests, the victim did not need to intentionally submit a sharing-group change form.
What remediation is described?
Apply the patch that restores centralized HTTP method enforcement in __initialiseSGQuickEdit(). The fix requires POST requests for all four affected quick-edit operations using allowMethod(['post']).