A cross-site request forgery (CSRF) vulnerability exists in MISP due to form-security and CSRF protections being disabled based on whether an… (CVE-2026-85547)

MISP's CSRF protections are bypassed when requests are identified as REST requests, which is determined by request properties like URL suffix or the HTTP Accept header. Because the Accept: application/json header can be sent cross-origin without CORS preflight, an attacker can craft requests from another website that MISP treats as REST and disables CSRF protections, even if the request is authenticated via the victim's browser session. This allows an attacker to induce an authenticated user to perform unauthorized state-changing actions on MISP endpoints. The root cause is that form-security exemptions are granted based on the _isRest() function rather than the authentication mechanism. The fix requires that only requests with a MISP API key are exempt from CSRF protections, while session-authenticated REST requests remain protected. Additionally, the patch introduces support for CSRF tokens sent via the X-CSRF-Token header for same-origin AJAX requests, which cannot be forged cross-origin without CORS preflight, mitigating the attack vector.

An attacker can exploit this vulnerability to perform unauthorized state-changing operations on MISP by leveraging an authenticated user's session. This could lead to unauthorized modification, creation, publication, or deletion of data within MISP depending on the victim's permissions. The vulnerability affects the integrity of MISP data and operations but requires the victim to be authenticated and interact with a malicious web page. There is no indication of remote unauthenticated exploitation or data disclosure beyond the described CSRF impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described fix changes CSRF exemption logic to require a valid API key and adds support for CSRF tokens via the X-CSRF-Token header for AJAX requests. Until a patch is applied, users should avoid interacting with untrusted websites while authenticated to MISP. Once the patch is available, apply it promptly to ensure CSRF protections are properly enforced.