CVE-2026-85546
Received Received - Intake

CSRF in MISP Sharing Group Quick-Edit

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: CIRCL

Description
MISP contains a cross-site request forgery (CSRF) vulnerability in the sharing group quick-edit functionality. The addOrg, removeOrg, addServer, and removeServer actions share the __initialiseSGQuickEdit() helper, where the HTTP method validation intended to restrict these operations to POST requests was commented out. As a result, these state-changing actions could be invoked using GET requests. An attacker could craft a URL targeting one of the affected actions and cause an authenticated MISP user with sufficient privileges to request it, for example through a malicious link or embedded web resource. Successful exploitation could modify the membership of a MISP sharing group without the victim intentionally performing the operation. Depending on the action performed, an attacker could add or remove organisations or servers from a sharing group, potentially granting unintended access to information distributed through that sharing group or disrupting legitimate information sharing. The patch restores HTTP method enforcement centrally in __initialiseSGQuickEdit() by calling allowMethod(['post']), ensuring that all four affected quick-edit operations require POST requests and are therefore subject to the application's normal protections for state-changing requests.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-85546
EUVD
EUVD-2026-70981

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a cross-site request forgery (CSRF) in MISP's sharing group quick-edit functionality. The issue occurs because HTTP method validation for state-changing actions (addOrg, removeOrg, addServer, removeServer) was disabled, allowing these operations to be triggered via GET requests instead of POST requests. An attacker could exploit this by crafting a malicious link that performs unauthorized actions when clicked by an authenticated user with sufficient privileges.

Detection Guidance

To detect this vulnerability, monitor HTTP GET requests targeting MISP sharing group quick-edit actions (addOrg, removeOrg, addServer, removeServer). Check server logs for unusual GET requests modifying sharing group memberships. Ensure the application enforces POST requests for these actions.

Impact Analysis

If exploited, this vulnerability could allow an attacker to modify the membership of a MISP sharing group without the victim's knowledge. This could result in unintended access to shared information or disruption of legitimate information sharing. For example, an attacker could add or remove organizations or servers from a sharing group, potentially exposing sensitive data or preventing authorized users from accessing it.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized modifications to sharing group memberships. An attacker could add or remove organizations or servers from a sharing group, which might lead to unintended access to sensitive information or disruption of legitimate data sharing. This could result in violations of data protection requirements under GDPR (e.g., unauthorized data access) or HIPAA (e.g., breaches of protected health information).

Mitigation Strategies

Apply the patch from the MISP repository commit 3060d93cb to enforce POST request validation for sharing group quick-edit actions. This prevents unauthorized GET requests from modifying sharing group memberships.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85546. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart