# CVE-2026-91857

## Summary

- **CVE ID:** CVE-2026-91857
- **Severity:** MEDIUM
- **CVSS Score:** 5.3 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N)
- **CWE:** CWE-352
- **Published:** Sep 15, 2026
- **Last Modified:** Sep 15, 2026

## Description

Affected versions of MISP expose several state-changing controller actions without restricting them to POST.


The affected actions are:



 - EventReportsController::purgeUnusedPictures()

 - NoticelistsController::enableNoticelist()

 - ServersController::removeOrphanedCorrelations()

 - WorkflowsController::rebuildRedis()






The patch adds allowMethod(['post']) to each action, preventing them from being triggered through ordinary GET requests.


For purgeUnusedPictures(), the corresponding UI previously used $.get(). The fix converts that request to POST and supplies X-CSRF-Token, while the controller enables header-only CSRF validation for that AJAX action.


Because GET requests can be induced cross-origin through links, images, redirects, or navigation, accepting GET for these state-changing operations can let an attacker trigger them using the authenticated victim's session.

Version affected: ≤2.5.45

## Affected Products

- MISP — MISP (0)

## References

- [CNA](https://github.com/MISP/MISP/commit/b4a5486b5)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.17%
- **EPSS Percentile:** 6.8

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-17._