CVE-2026-91819
Received Received - Intake

CSRF Bypass via HTTP Method Override in MISP

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: CIRCL

Description
Affected versions of MISP rely on CakePHP request-method override processing in a way that can disable CSRF and form-security validation. CakePHP honors a _method field or X-HTTP-Method-Override header by rewriting the effective request method. For override values outside the normal write verbs POST, PUT, PATCH, and DELETE, CakePHP also clears the parsed request body. MISP’s security component then determines whether to perform _validatePost() and _validateCsrf() based on whether request data remains. With a value such as: _method=GET the body becomes empty before those checks run, so both protections are skipped. A cross-site form containing only that override can therefore reach actions whose parameters are taken from the URL rather than the request body Version affected: ≤2.5.45

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-91819
EUVD
EUVD-2026-78317

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
misp misp to 2.5.45 (exc)
cakephp cakephp to 2.5.45 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects MISP versions 2.5.45 and earlier. It involves CakePHP's request-method override processing which can disable CSRF and form-security validation. When an attacker sends a request with a _method override set to a value outside POST, PUT, PATCH, or DELETE (like _method=GET), CakePHP clears the request body. MISP's security checks depend on the presence of request data, so with an empty body, both CSRF and form validation are skipped. This allows malicious cross-site form submissions to bypass security entirely.

Detection Guidance

Check MISP logs for requests containing _method=GET or similar overrides. Inspect HTTP headers for X-HTTP-Method-Override with unsafe values. Use network monitoring tools to detect requests bypassing CSRF checks.

Impact Analysis

If you use MISP versions 2.5.45 or earlier, an attacker could exploit this to bypass security protections. This might allow unauthorized actions to be performed via crafted requests, potentially leading to data theft, unauthorized modifications, or other malicious activities. The impact depends on the specific actions exposed by the vulnerable application.

Mitigation Strategies

Upgrade MISP to version 2.5.46 or later. Apply the security patch from the GitHub commit 29af008c4. Review and update firewall rules to block suspicious method overrides.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-91819. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart