MISP contains a cross-site request forgery (CSRF) vulnerability in the sharing group quick-edit functionality. (CVE-2026-85546)

The MISP platform contains a CSRF vulnerability in the sharing group quick-edit feature. Specifically, the addOrg, removeOrg, addServer, and removeServer actions share a helper function (__initialiseSGQuickEdit()) where the HTTP method validation was disabled by commenting out the enforcement code. This omission allows these state-changing operations to be triggered via GET requests instead of POST, bypassing normal protections against CSRF. An attacker can craft a malicious URL that, when visited by an authenticated user with appropriate privileges, causes unauthorized changes to sharing group memberships. The vulnerability is mitigated by restoring the allowMethod(['post']) call in the helper function, ensuring these operations require POST requests and are protected by the application's CSRF defenses.

Successful exploitation allows an attacker to modify the membership of a MISP sharing group without the victim's intent. This can result in unauthorized addition or removal of organizations or servers from sharing groups, potentially granting unintended access to sensitive information shared within those groups or disrupting legitimate information sharing workflows. The impact is limited to users with sufficient privileges and requires the victim to be authenticated.

A patch has been implemented that restores HTTP method enforcement in the __initialiseSGQuickEdit() helper function by requiring POST requests for the affected quick-edit operations. This ensures that normal protections against CSRF attacks apply. Users and administrators should apply this patch to mitigate the vulnerability. Since the vendor advisory confirms the fix, no additional temporary mitigations are necessary.