CVE-2026-91857: MISP: State-changing actions accessible via GET request enabling CSRF
Affected versions of MISP expose several state-changing controller actions without restricting them to POST.
The affected actions are:
- EventReportsController::purgeUnusedPictures()
- NoticelistsController::enableNoticelist()
- ServersController::removeOrphanedCorrelations()
- WorkflowsController::rebuildRedis()
The patch adds allowMethod(['post']) to each action, preventing them from being triggered through ordinary GET requests.
For purgeUnusedPictures(), the corresponding UI previously used $.get(). The fix converts that request to POST and supplies X-CSRF-Token, while the controller enables header-only CSRF validation for that AJAX action.
Because GET requests can be induced cross-origin through links, images, redirects, or navigation, accepting GET for these state-changing operations can let an attacker trigger them using the authenticated victim's session.
Version affected: ≤2.5.45
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Add CakePHP allowMethod(['post']) guards to these state-changing controller actions so they cannot be triggered via ordinary GET requests: WorkflowsController::rebuildRedis(), EventReportsController::purgeUnusedPictures(), NoticelistsController::enableNoticelist(), ServersController::removeOrphanedCorrelations(). Affected versions are stated as ≤2.5.45.
MISP (CakePHP controllers) allowMethod(['post']) = Restrict state-changing actions to POST only - Configuration
Update purgeUnusedPictures() client-side code to issue a POST request (replacing the prior $.get()) and include the page CSRF token in the X-CSRF-Token header.
MISP client-side JavaScript for purgeUnusedPictures() AJAX request method and CSRF header = POST with X-CSRF-Token header containing the page CSRF token - Configuration
Add a beforeFilter() hook in EventReportsController to configure header-only CSRF token validation for the purgeUnusedPictures() action, since it is invoked via hand-built AJAX rather than a rendered form.
EventReportsController::purgeUnusedPictures() CSRF handling beforeFilter CSRF validation mode = Header-only CSRF token validation for that specific action
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Authenticated MISP users whose sessions can be used by a browser are exposed if they can reach the affected controller actions. An attacker can induce a victim's browser to send a GET request through a link, image, redirect, or navigation.
What actions could an attacker trigger through a victim's authenticated session?
The affected actions are purging unused event-report pictures, enabling a noticelist, removing orphaned correlations, and rebuilding Redis workflows. The data does not specify the authorization level required for each action.
Are default CSRF protections sufficient for these actions?
No. The issue exists because these state-changing actions accepted GET requests, which can be triggered cross-origin. The fix restricts each action to POST; the purge-unused-pictures AJAX request also sends an X-CSRF-Token and uses header-only CSRF validation.
Which versions are affected?
MISP versions 2.5.45 and earlier are affected.