CVE-2026-73162 in cti-transmute
Summary
by MITRE • 08/11/2026
Affected versions of MISP cti-transmute expose several state-changing account operations as GET requests:
* /account/follow
* /account/delete_notification
* /account/mark_notification_read
* /account/mark_all_read
These endpoints require authentication, but before the fix they could be invoked with simple GET requests. That makes them susceptible to cross-site request forgery because a third-party site can induce the victim’s browser to send authenticated GET requests automatically.
The patch converts the actions to POST or DELETE and updates the frontend to include an X-CSRFToken header, providing explicit CSRF protection for those state-changing operations.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/11/2026
The vulnerability in MISP cti-transmute represents a critical cross-site request forgery weakness that exploits improper HTTP method usage for state-changing operations. This flaw allows attackers to manipulate authenticated user sessions through malicious web pages that automatically submit GET requests to sensitive endpoints. The affected URLs /account/follow, /account/delete_notification, /account/mark_notification_read, and /account/mark_all_read all operate under the assumption that authentication validation occurs before request processing, but the lack of proper method enforcement creates an exploitable vector where user browsers execute these actions without explicit user consent.
The technical implementation flaw stems from the application's failure to enforce HTTP method semantics properly. According to CWE-352 Cross-Site Request Forgery, this vulnerability occurs when applications permit state-changing operations to be executed via GET requests, which should never be used for operations that modify server state. The attack vector leverages the fact that browsers automatically execute GET requests from third-party sites, making it trivial for adversaries to craft malicious pages that perform unauthorized actions on behalf of authenticated users. This pattern directly violates the principle of least privilege and improper handling of HTTP methods as outlined in the OWASP Top Ten.
The operational impact of this vulnerability extends beyond simple account manipulation to potentially compromise user data integrity and privacy. An attacker could follow unintended accounts, delete critical notifications, or mark all notifications as read, effectively disrupting user workflows and potentially hiding important security alerts. The severity increases significantly when considering that these operations are typically performed by authenticated users with elevated privileges within the MISP ecosystem. This creates opportunities for information leakage, denial of service scenarios, and potential escalation to more serious attacks if combined with other vulnerabilities.
The remediation implemented addresses the core issue by converting the vulnerable GET endpoints to POST or DELETE methods, which aligns with proper RESTful API design principles and security best practices. This change requires clients to submit requests with appropriate HTTP methods that are not automatically executed by browsers in response to page loading. The addition of X-CSRFToken header requirement ensures that only legitimate requests from the application itself can successfully execute these operations, as the token must be generated and validated server-side. This approach provides explicit CSRF protection that conforms to industry standards such as those recommended in the OWASP CSRF Prevention Cheat Sheet and aligns with ATT&CK technique T1566.002 for credential access through web-based attacks.
The fix demonstrates proper application of security controls including HTTP method enforcement, explicit token validation, and appropriate request handling. By requiring POST or DELETE methods along with CSRF tokens, the implementation prevents automated execution of state-changing operations while maintaining legitimate user functionality. This solution addresses both the immediate vulnerability and establishes a pattern for future endpoint design that considers security implications of HTTP method usage and request handling. The updated frontend code ensures proper header inclusion and method selection, creating a robust defense against CSRF attacks while preserving all intended application functionality and user experience.