CVE-2026-91819 Details
Description
Affected versions of MISP rely on CakePHP request-method override processing in a way that can disable CSRF and form-security validation. CakePHP honors a _method field or X-HTTP-Method-Override header by rewriting the effective request method. For override values outside the normal write verbs POST, PUT, PATCH, and DELETE, CakePHP also clears the parsed request body. MISP’s security component then determines whether to perform _validatePost() and _validateCsrf() based on whether request data remains. With a value such as: _method=GET the body becomes empty before those checks run, so both protections are skipped. A cross-site form containing only that override can therefore reach actions whose parameters are taken from the URL rather than the request body Version affected: ≤2.5.45
A vulnerability in MISP versions through 2.5.45 allows Cross-Site Request Forgery (CSRF) by exploiting how CakePHP handles request method overrides. CakePHP rewrites the request method based on an '_method' field or 'X-HTTP-Method-Override' header. For methods outside the standard write verbs (POST, PUT, PATCH, DELETE), it clears the request body. This behavior can be manipulated to bypass CSRF protections, as MISP's security component relies on the presence of request data to validate forms and CSRF tokens. By sending a form that includes '_method=GET', the request body is emptied, causing MISP to skip these security checks and allowing the action to be processed without proper validation.
Users can update to MISP version 2.5.47 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 15, 2026CISA-ADP
Assessed Sep 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/MISP/MISP/commit/29af008c4 | CIRCL | Source CodeVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-20 | Improper Input Validation | CIRCL |
| CWE-352 | Cross-Site Request Forgery (CSRF) | CIRCL |
Affected Products
| Product | Versions |
|---|---|
| MISP | <= 2.5.45 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 15, 2026 | CVE Modified | CISA-ADP |
| Sep 15, 2026 | New CVE Received | CIRCL |