CVE-2026-85547

What it is

A cross-site request forgery (CSRF) vulnerability exists in MISP due to form-security and CSRF protections being disabled based on whether an incoming request was identified as a REST request. MISP's REST detection can be influenced by request properties such as the URL suffix or the HTTP Accept header. Because Accept: application/json can be supplied by a cross-origin page without requiring a CORS preflight, an attacker could cause a request originating from another website to be treated as REST traffic. MISP would consequently disable its normal form-security and CSRF validation even though the request was authenticated using the victim's existing browser session. An unauthenticated remote attacker could exploit this behavior by convincing an authenticated MISP user to visit or interact with a malicious web page. The attacker's page could then issue crafted requests to susceptible state-changing MISP endpoints using the victim's privileges. Depending on the permissions of the victim and the targeted endpoint, this could allow unauthorized modification, creation, publication, or removal of data and other state changes. The vulnerability originates from granting the form-security exemption based on _isRest() rather than on the authentication mechanism used by the request. The patch changes this behavior so that CSRF and form-security exemptions are granted only when the request actually carries a MISP API key. Session-authenticated REST-style requests remain subject to CSRF protection. The fix also introduces support for transmitting CSRF tokens through the X-CSRF-Token header for legitimate same-origin AJAX requests. Such a header cannot normally be attached by a cross-origin page without triggering a CORS preflight, preventing it from being used to reproduce the original attack.

At a glance

Exploitability

Can be exploited over the network without logging in, but needs a user to act. Limited direct impact.

Exploit odds

0.4% chance of exploitation in the next 30 days (EPSS).

Fix

A patch, advisory or fixed version is referenced. Upgrade or apply it.

Timeline

1. 2026-09-04 10:17 UTC PublishedDisclosed publicly on CVE.org and NVD
2. 2026-09-08 14:11 UTC Last updatedMost recent change to the record

Details

Published

2026-09-04 10:17 UTC

Last modified

2026-09-08 14:11 UTC

Exploit probability

0.4% · EPSS, next 30 days

Weakness

CWE-352 · Cross-site request forgery

Record status

Awaiting Analysis

Attack profile CVSS 4.0 · 6.2

Attack vector

Network

Complexity

Low

Attack requirements

None

Privileges needed

None

User interaction

Active

Confidentiality

None

Integrity

Low

Availability

Low