CVE-2026-94404 in MISP
Summary
by MITRE • 09/21/2026
MISP has a security issue that could let an attacker change threat-intelligence data through a logged-in user’s browser without that user knowingly approving the change.
The affected function did not properly enforce MISP’s usual protection against forged requests. Because of this, an attacker could create a malicious webpage that silently sends a request to MISP when visited by an authenticated user.
If successful, the attacker could change details of an attribute, such as its value, type, category, comment, distribution settings, or related timestamps.
The attack requires the victim to already be logged in to MISP and to visit an attacker-controlled page.
The main impact is unauthorized modification of threat-intelligence data, which could lead to incorrect indicators, wrong classifications, or altered sharing settings and reduce confidence in the accuracy of the information stored in MISP.
Version affected: <2.5.47
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/21/2026
MISP versions prior to 2.5.47 are susceptible to a Cross-Site Request Forgery vulnerability that allows an attacker to manipulate threat intelligence data without the knowledge or consent of an authenticated user. This security flaw stems from insufficient enforcement of anti-forgery protections within specific functions, creating a gap in the application's defense against state-changing requests initiated by third-party sites. The core technical issue lies in the failure to properly validate request origins and tokens for certain endpoints that modify attribute details. Consequently, if an attacker can craft a malicious webpage containing automated requests targeting these vulnerable MISP endpoints, those requests will be processed as legitimate when executed within the context of a user who is currently authenticated with active session cookies or tokens.
The operational impact of this vulnerability centers on the unauthorized modification of critical threat intelligence attributes. An adversary leveraging this flaw could alter essential metadata associated with indicators of compromise, including changing attribute values, types, categories, and comments. Furthermore, the attacker can modify distribution settings, potentially restricting or expanding the visibility of sensitive data to unintended communities, and manipulate related timestamps to obscure the timeline of events. This capability undermines the integrity of the threat intelligence platform by introducing false positives, incorrect classifications, and altered sharing policies directly into the system's database without any explicit approval from the legitimate user.
The attack vector requires two primary conditions: the victim must be actively logged into their MISP instance with a valid session, and they must visit a webpage controlled by the attacker that contains the malicious payload. Once these conditions are met, the browser automatically includes authentication credentials in the forged requests sent to the MISP server due to standard HTTP cookie behavior. This results in silent data manipulation where the user remains unaware of the changes until discrepancies appear in their intelligence feeds or reports. The resulting degradation in confidence regarding the accuracy and reliability of stored information poses a significant risk to organizations relying on MISP for accurate threat detection and response coordination.
To mitigate this vulnerability, administrators should immediately upgrade to version 2.5.47 or later where these protections have been strengthened. In environments where upgrading is not immediately feasible, implementing additional controls such as strict SameSite cookie attributes can help prevent browsers from sending session cookies in cross-site requests. Additionally, deploying a Web Application Firewall with rules designed to detect and block anomalous request patterns typical of CSRF attacks may provide supplementary protection. Regular security audits focusing on the implementation of anti-CSRF tokens for all state-changing operations are also recommended to ensure robust defense against similar forgery attempts aligned with CWE-352 standards. This incident highlights the importance of maintaining rigorous input validation and session management practices within complex intelligence sharing platforms, as referenced in MITRE ATT&CK techniques related to command and control or data exfiltration via trusted applications.