CVE-2026-90893 in MISP
Summary
by MITRE • 09/14/2026
MISP contains a Cross-Site Request Forgery (CSRF) vulnerability in the UserSettingsController. The actions setTheme, setHomePage, and eventIndexColumnToggle were explicitly added to the Security component's unlockedActions list, which disabled all CSRF validation (both token and field-hash checks) for those endpoints. Because these endpoints accept POST requests and modify per-user application state (theme selection, default homepage URL, and event index column visibility), an attacker who can induce a logged-in MISP user to load a malicious page (e.g., via a crafted link, embedded image, or auto-submitting form) can forge requests that alter the victim's settings without their knowledge or consent. The most impactful action is setHomePage, which allows an attacker to redirect the victim's default landing page to an arbitrary attacker-controlled URL, potentially facilitating phishing or further social engineering. The setTheme action can alter the user's visual theme, and eventIndexColumnToggle can change which columns are displayed in the event index view. No authentication bypass is involved; the victim must already be authenticated to MISP. The vulnerability was reported by the Scottish Government National Cyber Team.
Version affected: ≤2.5.45
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/14/2026
The disclosed security issue within the Management of Incident Security Projects (MISP) platform represents a critical Cross-Site Request Forgery vulnerability located in the UserSettingsController component. This flaw stems from an improper configuration of the application's security middleware, specifically where certain actions were explicitly added to the unlockedActions list within the Security component. By designating these endpoints as exempt from CSRF validation mechanisms, including both token verification and field-hash checks, the system inadvertently removed a fundamental layer of defense against unauthorized state-changing requests. The affected operations include setTheme, which modifies visual presentation settings; eventIndexColumnToggle, which alters interface layout preferences by changing column visibility in the event index view; and most critically, setHomePage, which defines the default landing page URL for authenticated users. This architectural oversight allows any actor capable of inducing a logged-in user to interact with a malicious web resource to execute these actions without the victim's knowledge or consent.
From an operational perspective, the impact of this vulnerability varies in severity depending on the specific endpoint exploited. While altering visual themes or column visibility primarily affects usability and aesthetic preferences, potentially causing confusion or minor disruption to workflow efficiency, the setHomePage action poses a significant threat to user safety and organizational security posture. By forcing the victim's default homepage to redirect to an arbitrary URL controlled by an attacker, malicious actors can facilitate sophisticated phishing campaigns. Users who habitually access MISP via their browser bookmarks or home page shortcuts may be seamlessly redirected to a counterfeit login portal designed to harvest credentials or deliver malware. This capability transforms a configuration flaw into a vector for broader social engineering attacks and potential account compromise, especially given that the victim must already possess valid authentication tokens within an active session for the attack to succeed.
This vulnerability aligns with CWE-352, which classifies Cross-Site Request Forgery as a weakness where a web application executes unwanted commands on behalf of an authenticated user without their consent. Furthermore, in the context of the MITRE ATT&CK framework, this behavior corresponds to techniques involving social engineering and credential harvesting, specifically under tactics such as Initial Access or Credential Access if phishing is employed via the redirected homepage. The attack vector relies heavily on the victim's existing session state, meaning that while no authentication bypass occurs, the integrity of user-specific configurations is completely compromised. Attackers can leverage common delivery methods such as crafted hyperlinks embedded in emails, images hosted on malicious sites with hidden form submissions, or auto-submitting forms triggered by page loads to execute these forged requests against the MISP instance.
To mitigate this risk, immediate remediation involves removing setTheme, setHomePage, and eventIndexColumnToggle from the Security component's unlockedActions list, thereby re-enabling standard CSRF token validation for all state-changing POST requests. Developers should ensure that any endpoint modifying user-specific settings implements robust anti-CSRF measures consistent with OWASP guidelines, including synchronizer tokens or double-submit cookie patterns. For organizations currently running versions of MISP less than or equal to 2.5.45, upgrading to a patched version is the primary corrective action. Until an update can be applied, administrators should consider implementing strict Content Security Policy headers and ensuring that sensitive administrative interfaces are not accessible via simple GET requests where possible, although this specific flaw affects POST endpoints requiring session cookies. Continuous monitoring of user settings changes and enforcing multi-factor authentication for all MISP accounts can also help reduce the potential impact if such a forgery attempt is successfully executed.