CVE-2026-94404: MISP CSRF vulnerability allows unauthorized attribute modification
MISP has a security issue that could let an attacker change threat-intelligence data through a logged-in user’s browser without that user knowingly approving the change.
The affected function did not properly enforce MISP’s usual protection against forged requests. Because of this, an attacker could create a malicious webpage that silently sends a request to MISP when visited by an authenticated user.
If successful, the attacker could change details of an attribute, such as its value, type, category, comment, distribution settings, or related timestamps.
The attack requires the victim to already be logged in to MISP and to visit an attacker-controlled page.
The main impact is unauthorized modification of threat-intelligence data, which could lead to incorrect indicators, wrong classifications, or altered sharing settings and reduce confidence in the accuracy of the information stored in MISP.
Version affected: <2.5.47
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MISPto a version that resolves this vulnerability.Fixed in 2.5.47 - Configuration
In the MISP Security component, remove the editField action from the Security component's unlockedActions list (so it is no longer exempt from CSRF protections).
MISP Security component unlockedActions (editField) = removed from unlockedActions list - Configuration
In the MISP Security component, add the editField action to the _csrfTokenHeaderOnly array to enforce CSRF token validation via the allowed mechanism(s) described: accept CSRF token either in the X-CSRF-Token header or in the request body while dropping only the field-hash check that existing AJAX callers cannot satisfy.
MISP Security component _csrfTokenHeaderOnly (editField) = added to _csrfTokenHeaderOnly array
Event History
Frequently Asked Questions
Who is exposed to this issue?
MISP instances running a version earlier than 2.5.47 are affected. Exploitation requires a user who is already authenticated to the instance.
What does an attacker need to exploit it?
The attacker must cause an authenticated MISP user to visit an attacker-controlled webpage. That page can silently submit a forged request through the victim’s browser without the victim knowingly approving the change.
What can be changed if exploitation succeeds?
An attacker can modify an attribute’s value, type, category, comment, distribution settings, or related timestamps. This can introduce incorrect indicators, alter classifications or sharing settings, and undermine trust in stored threat-intelligence data.
How can the issue be remediated?
Upgrade MISP to version 2.5.47 or later. The affected versions are those earlier than 2.5.47.