CVE-2026-94404
Deferred Deferred - Pending Action

Cross-Site Request Forgery in MISP Threat-Intelligence Platform

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: CIRCL

Description
MISP has a security issue that could let an attacker change threat-intelligence data through a logged-in user’s browser without that user knowingly approving the change. The affected function did not properly enforce MISP’s usual protection against forged requests. Because of this, an attacker could create a malicious webpage that silently sends a request to MISP when visited by an authenticated user. If successful, the attacker could change details of an attribute, such as its value, type, category, comment, distribution settings, or related timestamps. The attack requires the victim to already be logged in to MISP and to visit an attacker-controlled page. The main impact is unauthorized modification of threat-intelligence data, which could lead to incorrect indicators, wrong classifications, or altered sharing settings and reduce confidence in the accuracy of the information stored in MISP. Version affected: <2.5.47

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-21
Last Modified
2026-09-21
Generated
2026-09-21
AI Q&A
2026-09-21
EPSS Evaluated
N/A
NVD
CVE-2026-94404
EUVD
EUVD-2026-83917

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
circl misp to 2.5.47 (exc)
misp misp to 2.5.47 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

MISP has a vulnerability where an attacker can change threat-intelligence data through a logged-in user's browser without the user's knowledge. The affected function did not enforce protection against forged requests, allowing an attacker to create a malicious webpage that silently sends a request to MISP when visited by an authenticated user. This could modify attribute details like value, type, category, comment, distribution settings, or timestamps.

Detection Guidance

This vulnerability involves a CSRF bypass in MISP's inline attribute field edit functionality. To detect it, check if your MISP instance is running a version older than 2.5.47. Review server logs for suspicious POST requests to /attributes/editField or similar endpoints without proper CSRF tokens. Monitor for unauthorized changes to threat-intelligence data attributes.

Impact Analysis

If you use MISP versions before 2.5.47, an attacker could trick you into visiting a malicious page while logged into MISP. This could lead to unauthorized changes in threat-intelligence data, such as incorrect indicators, wrong classifications, or altered sharing settings. This reduces trust in the accuracy of the information stored in MISP.

Compliance Impact

This vulnerability could lead to unauthorized modification of threat-intelligence data in MISP, potentially causing incorrect indicators or classifications. Such inaccuracies might violate data integrity requirements under GDPR and HIPAA, where maintaining accurate and unaltered records is critical for compliance.

Mitigation Strategies

Upgrade MISP to version 2.5.47 or later immediately. Ensure all users are logged out and back in to invalidate any active sessions. Review recent changes to attributes for signs of tampering. Implement additional CSRF protections if not already in place.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-94404. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart