CVE-2026-90893: MISP UserSettingsController CSRF Protection Bypass on setTheme, setHomePage, and eventIndexColumnToggle Endpoints
MISP contains a Cross-Site Request Forgery (CSRF) vulnerability in the UserSettingsController. The actions setTheme, setHomePage, and eventIndexColumnToggle were explicitly added to the Security component's unlockedActions list, which disabled all CSRF validation (both token and field-hash checks) for those endpoints. Because these endpoints accept POST requests and modify per-user application state (theme selection, default homepage URL, and event index column visibility), an attacker who can induce a logged-in MISP user to load a malicious page (e.g., via a crafted link, embedded image, or auto-submitting form) can forge requests that alter the victim's settings without their knowledge or consent. The most impactful action is setHomePage, which allows an attacker to redirect the victim's default landing page to an arbitrary attacker-controlled URL, potentially facilitating phishing or further social engineering. The setTheme action can alter the user's visual theme, and eventIndexColumnToggle can change which columns are displayed in the event index view. No authentication bypass is involved; the victim must already be authenticated to MISP. The vulnerability was reported by the Scottish Government National Cyber Team.
Version affected: ≤2.5.45
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Edit MISP Security configuration so that the Security component no longer includes the actions setTheme, setHomePage, and eventIndexColumnToggle in the unlockedActions list (this list previously disabled CSRF checks including both token and field-hash checks for those endpoints).
MISP Security component unlockedActions list = Remove setTheme, setHomePage, eventIndexColumnToggle from Security component's unlockedActions list (they previously disabled all CSRF validation for these endpoints) - Configuration
Register the actions setTheme, setHomePage, and eventIndexColumnToggle under the header-only CSRF token validation mechanism (_csrfTokenHeaderOnly), so each request requires the X-CSRF-Token header to be present and valid (supporting AJAX/fetch calls without traditional form fields).
MISP Security component CSRF validation mode for endpoints = _csrfTokenHeaderOnly - Configuration
Update client-side JavaScript/view templates so that requests to these endpoints include the X-CSRF-Token header sourced from window.csrfToken, ensuring legitimate same-origin AJAX/fetch requests include a valid CSRF token and cross-origin forged requests are rejected.
MISP client-side JavaScript X-CSRF-Token header usage = Include X-CSRF-Token (from window.csrfToken) in all AJAX and fetch calls to setTheme, setHomePage, and eventIndexColumnToggle endpoints
Event History
Frequently Asked Questions
Which users are exposed to this issue?
Any user who is already authenticated to MISP can be targeted if they are induced to load attacker-controlled content that submits requests to the affected endpoints. This is not an authentication bypass; unauthenticated users are not able to have settings changed through their own MISP session.
What can an attacker change through the affected actions?
An attacker can change the victim's selected theme, default homepage URL, or event index column visibility. Changing the homepage is the most significant impact because it can direct the user to an arbitrary attacker-controlled URL when they next use their default landing page.
What does an attacker need to exploit this vulnerability?
The attacker needs to cause a logged-in MISP user to load a malicious page or crafted content, such as a link, embedded image, or auto-submitting form. No CSRF token or field hash is required for requests to setTheme, setHomePage, or eventIndexColumnToggle.
How can an administrator identify a potentially affected user?
Review user settings for unexpected changes to the default homepage URL, theme, or event-index column visibility. In particular, investigate homepage values that point to untrusted or attacker-controlled URLs.