CVE-2026-94404 (GCVE-0-2026-94404)
Vulnerability from cvelistv5
Published
2026-09-21 13:50
Modified
2026-09-21 14:48
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-352 - Cross-Site Request Forgery (CSRF)
Summary
MISP has a security issue that could let an attacker change threat-intelligence data through a logged-in user’s browser without that user knowingly approving the change.
The affected function did not properly enforce MISP’s usual protection against forged requests. Because of this, an attacker could create a malicious webpage that silently sends a request to MISP when visited by an authenticated user.
If successful, the attacker could change details of an attribute, such as its value, type, category, comment, distribution settings, or related timestamps.
The attack requires the victim to already be logged in to MISP and to visit an attacker-controlled page.
The main impact is unauthorized modification of threat-intelligence data, which could lead to incorrect indicators, wrong classifications, or altered sharing settings and reduce confidence in the accuracy of the information stored in MISP.
Version affected: <2.5.47
References
| URL | Tags | |
|---|---|---|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-94404",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-21T14:34:58.261364Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T14:48:16.245Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"AttributesController"
],
"product": "MISP",
"programFiles": [
"app/Controller/AttributesController.php"
],
"repo": "https://github.com/MISP/MISP",
"vendor": "MISP",
"versions": [
{
"lessThan": "2.5.47",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Jeroen Pinoy"
},
{
"lang": "en",
"type": "remediation developer",
"value": "iglocska"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Claude Opus 5 (1M context)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eMISP has a security issue that could let an attacker change threat-intelligence data through a logged-in user\u2019s browser without that user knowingly approving the change.\u003c/p\u003e\u003cp\u003eThe affected function did not properly enforce MISP\u2019s usual protection against forged requests. Because of this, an attacker could create a malicious webpage that silently sends a request to MISP when visited by an authenticated user.\u003c/p\u003e\u003cp\u003eIf successful, the attacker could change details of an attribute, such as its value, type, category, comment, distribution settings, or related timestamps.\u003c/p\u003e\u003cp\u003eThe attack requires the victim to already be logged in to MISP and to visit an attacker-controlled page.\u003c/p\u003e\u003cp\u003eThe main impact is unauthorized modification of threat-intelligence data, which could lead to incorrect indicators, wrong classifications, or altered sharing settings and reduce confidence in the accuracy of the information stored in MISP.\u003c/p\u003eVersion affected: \u0026lt;2.5.47"
}
],
"value": "MISP has a security issue that could let an attacker change threat-intelligence data through a logged-in user\u2019s browser without that user knowingly approving the change.\n\nThe affected function did not properly enforce MISP\u2019s usual protection against forged requests. Because of this, an attacker could create a malicious webpage that silently sends a request to MISP when visited by an authenticated user.\n\nIf successful, the attacker could change details of an attribute, such as its value, type, category, comment, distribution settings, or related timestamps.\n\nThe attack requires the victim to already be logged in to MISP and to visit an attacker-controlled page.\n\nThe main impact is unauthorized modification of threat-intelligence data, which could lead to incorrect indicators, wrong classifications, or altered sharing settings and reduce confidence in the accuracy of the information stored in MISP.\n\nVersion affected: \u003c2.5.47"
}
],
"impacts": [
{
"capecId": "CAPEC-124",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-124 Cross-Site Request Forgery"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "CWE-352 Cross-Site Request Forgery (CSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T13:50:46.410Z",
"orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"shortName": "CIRCL"
},
"references": [
{
"name": "Security patch",
"tags": [
"patch"
],
"url": "https://github.com/MISP/MISP/commit/dfbae33f9"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe editField action is removed from the Security component\u0027s unlockedActions list and added to the _csrfTokenHeaderOnly array. This enforces CSRF token validation (accepted either in the X-CSRF-Token header or in the request body) while dropping only the field-hash check, which the existing AJAX callers (Overmind index and legacy inline forms) cannot satisfy. Legitimate callers are unaffected because they already transmit a valid CSRF token.\u003c/p\u003e"
}
],
"value": "The editField action is removed from the Security component\u0027s unlockedActions list and added to the _csrfTokenHeaderOnly array. This enforces CSRF token validation (accepted either in the X-CSRF-Token header or in the request body) while dropping only the field-hash check, which the existing AJAX callers (Overmind index and legacy inline forms) cannot satisfy. Legitimate callers are unaffected because they already transmit a valid CSRF token."
}
],
"title": "MISP CSRF vulnerability allows unauthorized attribute modification",
"x_gcve": [
{
"extensions": {
"bcp-05-x-01": {
"ai_annotations": [
{
"ai_level": "generated",
"description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
"gna_source": 1,
"models": [
{
"gna_source": 1,
"identifier": "qwen3.8:27b",
"name": "qwen3.8:27b",
"source": "ollama"
}
],
"review_status": "review",
"scope": "record",
"tags": [
"ai-computer-assisted:llm-generated",
"ai-computer-assisted:classification"
]
}
]
},
"bcp-05-x-02": {
"x_patch2vuln": {
"assumptions": [
"The affected version range is inferred from the tag_version_boundary (v2.5.47 with 7 commits after the fix); no explicit \u0027affected\u0027 or \u0027fixed\u0027 version strings are provided in the metadata, so the exact version boundary is approximate.",
"UI:P (Passive) is assumed because the commit message describes a \u0027cross-site form post\u0027 that auto-submits when the victim\u0027s browser loads the attacker\u0027s page; if the attack requires the victim to explicitly click a link or submit a form, UI:A would be more appropriate.",
"PR:N is assumed because the attacker does not need their own MISP account; the victim\u0027s authenticated session cookie is sufficient. If MISP deployments require additional authentication factors (e.g., MFA) that would block a cross-site form post, the effective exploitability may be lower.",
"The CAPEC-124 mapping is the closest standard pattern for CSRF; no more specific CAPEC exists for the CakePHP unlockedActions bypass mechanism.",
"The Co-Authored-By AI tool is included as a \u0027tool\u0027 credit based on explicit commit metadata; it is not a human contributor."
],
"capecRationale": [
{
"capecId": "CAPEC-124",
"rationale": "The patch description explicitly states that a cross-site form post carrying the victim\u0027s session cookie could rewrite attribute fields. This is the canonical CSRF attack pattern: an attacker induces a victim\u0027s browser to send an authenticated request to a target application without the victim\u0027s knowledge or consent. CAPEC-124 is the most direct and specific match."
}
],
"commit": "dfbae33f9a93bf127fae115bc6cd1a9e03d028e9",
"confidence": "high",
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Jeroen Pinoy"
},
{
"lang": "en",
"type": "remediation developer",
"value": "iglocska"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Claude Opus 5 (1M context)"
}
],
"cvssRationale": "AV:N: The attack is delivered over the network via a malicious web page. AC:L: Crafting a CSRF form is straightforward and requires no race conditions or special timing. AT:N: The target MISP instance is not under the attacker\u0027s control. PR:N: The attacker needs no account on MISP; the victim\u0027s existing session is sufficient. UI:P: The victim must passively load the attacker\u0027s page (e.g., visit a link), which triggers the auto-submitting form; no explicit click or form submission by the victim is required. VC:N: The attack modifies data but does not disclose confidential information. VI:H: The attacker can alter attribute values, types, categories, distribution, and timestamps, corrupting threat-intelligence data for all users. VA:N: No denial-of-service impact is indicated. SC/SI/SA:N: No secondary impacts on other systems are evidenced.",
"fixSummary": "The editField action is removed from the Security component\u0027s unlockedActions list and added to the _csrfTokenHeaderOnly array. This enforces CSRF token validation (accepted either in the X-CSRF-Token header or in the request body) while dropping only the field-hash check, which the existing AJAX callers (Overmind index and legacy inline forms) cannot satisfy. Legitimate callers are unaffected because they already transmit a valid CSRF token.",
"generatedAt": "2026-09-21T13:38:54.473662Z",
"generator": "patch2vuln.py",
"model": "qwen3.8:27b",
"modelComparison": {
"rankings": [
{
"agreementScore": 9,
"assumptionCount": 5,
"confidence": "high",
"model": "qwen3.8:27b",
"score": 6
}
],
"selectedModel": "qwen3.8:27b",
"selectionMethod": "deterministic-consensus-v1",
"selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
},
"patchSha256": "beb65b8daaa1d2e649f1178cc7f2c774f4ba7e75a13cc000524eef566c4545c8",
"patchSummary": "In app/Controller/AttributesController.php, the string \u0027editField\u0027 is added to the _csrfTokenHeaderOnly() call in beforeFilter(), enabling header-or-body CSRF token validation for that action. Simultaneously, the line adding \u0027editField\u0027 to $this-\u003eSecurity-\u003eunlockedActions[] is removed, so the action is no longer exempt from CSRF checks. A comment block is added explaining that both the Overmind index (token in X-CSRF-Token header) and legacy inline forms (token in body) already carry a valid token, so only the unsatisfiable field-hash check is dropped.",
"patchTruncated": false,
"patches": [
{
"commit": "dfbae33f9a93bf127fae115bc6cd1a9e03d028e9",
"patchSha256": "beb65b8daaa1d2e649f1178cc7f2c774f4ba7e75a13cc000524eef566c4545c8",
"source": "https://github.com/MISP/MISP/commit/dfbae33f9.patch",
"sourceUrl": "https://github.com/MISP/MISP/commit/dfbae33f9.patch",
"subject": "fix: [security] Keep the CSRF check on the inline attribute"
}
],
"source": "https://github.com/MISP/MISP/commit/dfbae33f9.patch",
"subject": "fix: [security] Keep the CSRF check on the inline attribute",
"tagVersionBoundary": {
"commits_after_fix": 7,
"repository": "https://github.com/MISP/MISP",
"tag": "v2.5.47",
"version": "2.5.47",
"version_type": "semver"
},
"weaknessRationale": [
{
"cweId": "CWE-352",
"rationale": "The editField action was placed in unlockedActions, which explicitly bypassed the CSRF token check. This allowed a cross-site form post to modify attribute data using only the victim\u0027s session cookie, a textbook CSRF weakness."
}
]
}
}
},
"recordType": "advisory",
"vulnId": "GCVE-1-2026-20043"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"assignerShortName": "CIRCL",
"cveId": "CVE-2026-94404",
"datePublished": "2026-09-21T13:50:46.410Z",
"dateReserved": "2026-09-21T13:50:44.676Z",
"dateUpdated": "2026-09-21T14:48:16.245Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-94404\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-09-21T14:34:58.261364Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-09-21T14:39:16.731Z\"}}], \"cna\": {\"title\": \"MISP CSRF vulnerability allows unauthorized attribute modification\", \"x_gcve\": [{\"vulnId\": \"GCVE-1-2026-20043\", \"extensions\": {\"bcp-05-x-01\": {\"ai_annotations\": [{\"tags\": [\"ai-computer-assisted:llm-generated\", \"ai-computer-assisted:classification\"], \"scope\": \"record\", \"models\": [{\"name\": \"qwen3.8:27b\", \"source\": \"ollama\", \"gna_source\": 1, \"identifier\": \"qwen3.8:27b\"}], \"ai_level\": \"generated\", \"gna_source\": 1, \"description\": \"Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.\", \"review_status\": \"review\"}]}, \"bcp-05-x-02\": {\"x_patch2vuln\": {\"model\": \"qwen3.8:27b\", \"commit\": \"dfbae33f9a93bf127fae115bc6cd1a9e03d028e9\", \"source\": \"https://github.com/MISP/MISP/commit/dfbae33f9.patch\", \"credits\": [{\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"Jeroen Pinoy\"}, {\"lang\": \"en\", \"type\": \"remediation developer\", \"value\": \"iglocska\"}, {\"lang\": \"en\", \"type\": \"remediation developer\", \"value\": \"Claude Opus 5 (1M context)\"}], \"patches\": [{\"commit\": \"dfbae33f9a93bf127fae115bc6cd1a9e03d028e9\", \"source\": \"https://github.com/MISP/MISP/commit/dfbae33f9.patch\", \"subject\": \"fix: [security] Keep the CSRF check on the inline attribute\", \"sourceUrl\": \"https://github.com/MISP/MISP/commit/dfbae33f9.patch\", \"patchSha256\": \"beb65b8daaa1d2e649f1178cc7f2c774f4ba7e75a13cc000524eef566c4545c8\"}], \"subject\": \"fix: [security] Keep the CSRF check on the inline attribute\", \"generator\": \"patch2vuln.py\", \"confidence\": \"high\", \"fixSummary\": \"The editField action is removed from the Security component\u0027s unlockedActions list and added to the _csrfTokenHeaderOnly array. This enforces CSRF token validation (accepted either in the X-CSRF-Token header or in the request body) while dropping only the field-hash check, which the existing AJAX callers (Overmind index and legacy inline forms) cannot satisfy. Legitimate callers are unaffected because they already transmit a valid CSRF token.\", \"assumptions\": [\"The affected version range is inferred from the tag_version_boundary (v2.5.47 with 7 commits after the fix); no explicit \u0027affected\u0027 or \u0027fixed\u0027 version strings are provided in the metadata, so the exact version boundary is approximate.\", \"UI:P (Passive) is assumed because the commit message describes a \u0027cross-site form post\u0027 that auto-submits when the victim\u0027s browser loads the attacker\u0027s page; if the attack requires the victim to explicitly click a link or submit a form, UI:A would be more appropriate.\", \"PR:N is assumed because the attacker does not need their own MISP account; the victim\u0027s authenticated session cookie is sufficient. If MISP deployments require additional authentication factors (e.g., MFA) that would block a cross-site form post, the effective exploitability may be lower.\", \"The CAPEC-124 mapping is the closest standard pattern for CSRF; no more specific CAPEC exists for the CakePHP unlockedActions bypass mechanism.\", \"The Co-Authored-By AI tool is included as a \u0027tool\u0027 credit based on explicit commit metadata; it is not a human contributor.\"], \"generatedAt\": \"2026-09-21T13:38:54.473662Z\", \"patchSha256\": \"beb65b8daaa1d2e649f1178cc7f2c774f4ba7e75a13cc000524eef566c4545c8\", \"patchSummary\": \"In app/Controller/AttributesController.php, the string \u0027editField\u0027 is added to the _csrfTokenHeaderOnly() call in beforeFilter(), enabling header-or-body CSRF token validation for that action. Simultaneously, the line adding \u0027editField\u0027 to $this-\u003eSecurity-\u003eunlockedActions[] is removed, so the action is no longer exempt from CSRF checks. A comment block is added explaining that both the Overmind index (token in X-CSRF-Token header) and legacy inline forms (token in body) already carry a valid token, so only the unsatisfiable field-hash check is dropped.\", \"cvssRationale\": \"AV:N: The attack is delivered over the network via a malicious web page. AC:L: Crafting a CSRF form is straightforward and requires no race conditions or special timing. AT:N: The target MISP instance is not under the attacker\u0027s control. PR:N: The attacker needs no account on MISP; the victim\u0027s existing session is sufficient. UI:P: The victim must passively load the attacker\u0027s page (e.g., visit a link), which triggers the auto-submitting form; no explicit click or form submission by the victim is required. VC:N: The attack modifies data but does not disclose confidential information. VI:H: The attacker can alter attribute values, types, categories, distribution, and timestamps, corrupting threat-intelligence data for all users. VA:N: No denial-of-service impact is indicated. SC/SI/SA:N: No secondary impacts on other systems are evidenced.\", \"capecRationale\": [{\"capecId\": \"CAPEC-124\", \"rationale\": \"The patch description explicitly states that a cross-site form post carrying the victim\u0027s session cookie could rewrite attribute fields. This is the canonical CSRF attack pattern: an attacker induces a victim\u0027s browser to send an authenticated request to a target application without the victim\u0027s knowledge or consent. CAPEC-124 is the most direct and specific match.\"}], \"patchTruncated\": false, \"modelComparison\": {\"rankings\": [{\"model\": \"qwen3.8:27b\", \"score\": 6, \"confidence\": \"high\", \"agreementScore\": 9, \"assumptionCount\": 5}], \"selectedModel\": \"qwen3.8:27b\", \"selectionMethod\": \"deterministic-consensus-v1\", \"selectionNotice\": \"The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required.\"}, \"weaknessRationale\": [{\"cweId\": \"CWE-352\", \"rationale\": \"The editField action was placed in unlockedActions, which explicitly bypassed the CSRF token check. This allowed a cross-site form post to modify attribute data using only the victim\u0027s session cookie, a textbook CSRF weakness.\"}], \"tagVersionBoundary\": {\"tag\": \"v2.5.47\", \"version\": \"2.5.47\", \"repository\": \"https://github.com/MISP/MISP\", \"version_type\": \"semver\", \"commits_after_fix\": 7}}}}, \"recordType\": \"advisory\"}], \"credits\": [{\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"Jeroen Pinoy\"}, {\"lang\": \"en\", \"type\": \"remediation developer\", \"value\": \"iglocska\"}, {\"lang\": \"en\", \"type\": \"remediation developer\", \"value\": \"Claude Opus 5 (1M context)\"}], \"impacts\": [{\"capecId\": \"CAPEC-124\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-124 Cross-Site Request Forgery\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV4_0\": {\"Safety\": \"NOT_DEFINED\", \"version\": \"4.0\", \"Recovery\": \"NOT_DEFINED\", \"baseScore\": 7.1, \"Automatable\": \"NOT_DEFINED\", \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"valueDensity\": \"NOT_DEFINED\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N\", \"providerUrgency\": \"NOT_DEFINED\", \"userInteraction\": \"PASSIVE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"NONE\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"HIGH\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"NONE\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"NONE\", \"vulnerabilityResponseEffort\": \"NOT_DEFINED\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"repo\": \"https://github.com/MISP/MISP\", \"vendor\": \"MISP\", \"modules\": [\"AttributesController\"], \"product\": \"MISP\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"2.5.47\", \"versionType\": \"semver\"}], \"programFiles\": [\"app/Controller/AttributesController.php\"]}], \"solutions\": [{\"lang\": \"en\", \"value\": \"The editField action is removed from the Security component\u0027s unlockedActions list and added to the _csrfTokenHeaderOnly array. This enforces CSRF token validation (accepted either in the X-CSRF-Token header or in the request body) while dropping only the field-hash check, which the existing AJAX callers (Overmind index and legacy inline forms) cannot satisfy. Legitimate callers are unaffected because they already transmit a valid CSRF token.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eThe editField action is removed from the Security component\u0027s unlockedActions list and added to the _csrfTokenHeaderOnly array. This enforces CSRF token validation (accepted either in the X-CSRF-Token header or in the request body) while dropping only the field-hash check, which the existing AJAX callers (Overmind index and legacy inline forms) cannot satisfy. Legitimate callers are unaffected because they already transmit a valid CSRF token.\u003c/p\u003e\", \"base64\": false}]}], \"references\": [{\"url\": \"https://github.com/MISP/MISP/commit/dfbae33f9\", \"name\": \"Security patch\", \"tags\": [\"patch\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"MISP has a security issue that could let an attacker change threat-intelligence data through a logged-in user\\u2019s browser without that user knowingly approving the change.\\n\\nThe affected function did not properly enforce MISP\\u2019s usual protection against forged requests. Because of this, an attacker could create a malicious webpage that silently sends a request to MISP when visited by an authenticated user.\\n\\nIf successful, the attacker could change details of an attribute, such as its value, type, category, comment, distribution settings, or related timestamps.\\n\\nThe attack requires the victim to already be logged in to MISP and to visit an attacker-controlled page.\\n\\nThe main impact is unauthorized modification of threat-intelligence data, which could lead to incorrect indicators, wrong classifications, or altered sharing settings and reduce confidence in the accuracy of the information stored in MISP.\\n\\nVersion affected: \u003c2.5.47\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eMISP has a security issue that could let an attacker change threat-intelligence data through a logged-in user\\u2019s browser without that user knowingly approving the change.\u003c/p\u003e\u003cp\u003eThe affected function did not properly enforce MISP\\u2019s usual protection against forged requests. Because of this, an attacker could create a malicious webpage that silently sends a request to MISP when visited by an authenticated user.\u003c/p\u003e\u003cp\u003eIf successful, the attacker could change details of an attribute, such as its value, type, category, comment, distribution settings, or related timestamps.\u003c/p\u003e\u003cp\u003eThe attack requires the victim to already be logged in to MISP and to visit an attacker-controlled page.\u003c/p\u003e\u003cp\u003eThe main impact is unauthorized modification of threat-intelligence data, which could lead to incorrect indicators, wrong classifications, or altered sharing settings and reduce confidence in the accuracy of the information stored in MISP.\u003c/p\u003eVersion affected: \u0026lt;2.5.47\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-352\", \"description\": \"CWE-352 Cross-Site Request Forgery (CSRF)\"}]}], \"providerMetadata\": {\"orgId\": \"5a6e4751-2f3f-4070-9419-94fb35b644e8\", \"shortName\": \"CIRCL\", \"dateUpdated\": \"2026-09-21T13:50:46.410Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-94404\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-09-21T14:48:16.245Z\", \"dateReserved\": \"2026-09-21T13:50:44.676Z\", \"assignerOrgId\": \"5a6e4751-2f3f-4070-9419-94fb35b644e8\", \"datePublished\": \"2026-09-21T13:50:46.410Z\", \"assignerShortName\": \"CIRCL\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…