CVE-2026-85546 in MISP
Summary
by MITRE • 09/04/2026
MISP contains a cross-site request forgery (CSRF) vulnerability in the sharing group quick-edit functionality. The addOrg, removeOrg, addServer, and removeServer actions share the __initialiseSGQuickEdit() helper, where the HTTP method validation intended to restrict these operations to POST requests was commented out.
As a result, these state-changing actions could be invoked using GET requests. An attacker could craft a URL targeting one of the affected actions and cause an authenticated MISP user with sufficient privileges to request it, for example through a malicious link or embedded web resource.
Successful exploitation could modify the membership of a MISP sharing group without the victim intentionally performing the operation. Depending on the action performed, an attacker could add or remove organisations or servers from a sharing group, potentially granting unintended access to information distributed through that sharing group or disrupting legitimate information sharing.
The patch restores HTTP method enforcement centrally in __initialiseSGQuickEdit() by calling allowMethod(['post']), ensuring that all four affected quick-edit operations require POST requests and are therefore subject to the application's normal protections for state-changing requests.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/04/2026
MISP, a widely deployed open-source threat intelligence sharing platform, contains a critical cross-site request forgery vulnerability within its sharing group management interface. This flaw specifically affects the quick-edit functionality used to manage organizational and server memberships within sharing groups. The root cause of this vulnerability lies in the __initialiseSGQuickEdit() helper function, which serves as the central entry point for several state-changing actions including addOrg, removeOrg, addServer, and removeServer. During a previous code modification or maintenance cycle, the HTTP method validation logic that was intended to restrict these operations exclusively to POST requests was inadvertently commented out. This oversight effectively removed the server-side check that distinguishes between safe data retrieval methods like GET and destructive state-modifying methods like POST, thereby exposing the application to request forgery attacks.
The technical implication of this missing validation is severe because it allows an attacker to trigger these administrative actions using simple HTTP GET requests rather than requiring a POST submission with appropriate anti-CSRF tokens or same-site cookie attributes that are typically enforced for write operations. In standard web security practices, state-changing endpoints must be protected against cross-site request forgery by ensuring they cannot be initiated via methods other than those explicitly intended for modification, such as POST, PUT, or DELETE. By allowing GET requests to execute these functions, MISP violates the principle of safe HTTP methods defined in industry standards like CWE-352, which classifies this type of flaw under Cross-Site Request Forgery (CSRF). An attacker can craft a malicious URL containing parameters that target one of the affected actions and embed it within an image tag, iframe, or hidden form on a website controlled by the adversary. When an authenticated MISP user with sufficient privileges visits the malicious page while their session is active, their browser will automatically include their authentication cookies in the request to the MISP server, causing the unintended modification to occur without the victim's knowledge or consent.
The operational impact of this vulnerability centers on the integrity and confidentiality of threat intelligence sharing groups. Sharing groups are fundamental mechanisms within MISP that define which organizations can view specific indicators of compromise (IOCs) and other sensitive data. If an attacker successfully exploits this CSRF flaw, they could add unauthorized organizations to a sharing group, thereby granting them access to information intended only for trusted partners. This constitutes a significant breach of confidentiality as it exposes potentially sensitive threat intelligence to untrusted entities who may have malicious intent or lack the necessary security posture to handle such data securely. Conversely, an attacker could also remove legitimate organizations from a sharing group, which disrupts operational continuity and hinders collaborative defense efforts among trusted peers. In either scenario, the integrity of the information sharing ecosystem is compromised, potentially leading to misdirected threat responses or exposure of proprietary intelligence assets.
From a strategic perspective, this vulnerability aligns with MITRE ATT&CK technique T1556, which covers Modifying Identity and Access Control mechanisms. By altering the membership list of a sharing group, an attacker effectively modifies access control policies within the application environment without proper authorization checks or user interaction beyond visiting a malicious site. This capability allows for persistent unauthorized access if new organizations are added with long-term privileges, making it difficult to detect solely through standard audit logs that may not immediately flag changes made via automated scripts or forged requests. The lack of explicit user confirmation steps during the quick-edit process further exacerbates the risk, as there is no secondary verification mechanism to catch such illicit modifications before they take effect.
To mitigate this vulnerability and prevent future occurrences, it is essential to enforce strict HTTP method validation at the framework level for all state-changing endpoints. As demonstrated by the patch applied in recent updates, restoring the allowMethod(['post']) call within the __initialiseSGQuickEdit() helper function ensures that only POST requests are accepted for these operations. This aligns with OWASP recommendations which advise using non-idempotent HTTP methods for actions that modify server state. Additionally, organizations should implement robust anti-CSRF token mechanisms tied to user sessions and validate them on every request that changes data. Regular security audits of web application frameworks can help identify instances where validation logic is commented out or bypassed during development cycles. For users running affected versions of MISP, immediate upgrading to the patched version is required to restore these critical protections. Administrators should also review recent sharing group modifications for any unauthorized additions or removals that may have occurred prior to patching and revert those changes if necessary to maintain the integrity of their threat intelligence distribution channels.