CVE-2026-85547: Cross-Site Request Forgery via Attacker-Controlled REST Detection in MISP
A cross-site request forgery (CSRF) vulnerability exists in MISP due to form-security and CSRF protections being disabled based on whether an incoming request was identified as a REST request.
MISP's REST detection can be influenced by request properties such as the URL suffix or the HTTP Accept header. Because Accept: application/json can be supplied by a cross-origin page without requiring a CORS preflight, an attacker could cause a request originating from another website to be treated as REST traffic. MISP would consequently disable its normal form-security and CSRF validation even though the request was authenticated using the victim's existing browser session.
An unauthenticated remote attacker could exploit this behavior by convincing an authenticated MISP user to visit or interact with a malicious web page. The attacker's page could then issue crafted requests to susceptible state-changing MISP endpoints using the victim's privileges. Depending on the permissions of the victim and the targeted endpoint, this could allow unauthorized modification, creation, publication, or removal of data and other state changes.
The vulnerability originates from granting the form-security exemption based on isRest() rather than on the authentication mechanism used by the request. The patch changes this behavior so that CSRF and form-security exemptions are granted only when the request actually carries a MISP API key. Session-authenticated REST-style requests remain subject to CSRF protection. The fix also introduces support for transmitting CSRF tokens through the X-CSRF-Token header for legitimate same-origin AJAX requests. Such a header cannot normally be attached by a cross-origin page without triggering a CORS preflight, preventing it from being used to reproduce the original attack.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Modify MISP so that CSRF and form-security exemptions are granted only if the incoming request contains a valid MISP API key; do not grant exemptions based on REST-style request detection (e.g., isRest(), URL suffix, or Accept: application/json).
MISP (form-security/CSRF handling) REST detection exemption logic (form-security and CSRF validation bypass) = Only bypass form-security and CSRF validation when the request actually carries a MISP API key (not based on isRest() / URL suffix / HTTP Accept header). - Configuration
Enable/ensure MISP accepts CSRF tokens provided in the X-CSRF-Token header for same-origin AJAX usage, in addition to any existing token mechanisms.
MISP CSRF token transport = Support transmitting CSRF tokens via the X-CSRF-Token header for legitimate same-origin AJAX requests.
Event History
Frequently Asked Questions
Who is exposed to this issue?
MISP users with active authenticated browser sessions are exposed if they can be persuaded to visit or interact with an attacker-controlled web page. The impact depends on the victim's MISP permissions and which state-changing endpoint is targeted.
What does an attacker need to exploit it?
The attacker does not need MISP credentials, but needs to induce an authenticated MISP user to load or interact with a malicious page. That page can send crafted cross-origin requests with request properties, such as Accept: application/json, that cause MISP to treat them as REST traffic.
Why can a cross-origin request bypass the expected protections?
MISP disables normal form-security and CSRF validation when it identifies a request as REST traffic. The REST classification can be influenced by the HTTP Accept header or URL suffix, and Accept: application/json can be sent by a cross-origin page without a CORS preflight.
How can we tell whether an attempted attack succeeded?
Review MISP activity and audit records for unexpected state-changing actions performed under legitimate user accounts, such as unauthorized data modifications, creation, publication, or removal. Focus on actions associated with users who may have visited untrusted pages while logged in.