CVE-2026-85236

Name of the Vulnerable Software and Affected Versions MISP (affected versions not specified)

Description A cross-site request forgery (CSRF) issue exists in the cullEmptyEvents action. The endpoint performs a state-changing and irreversible operation while accepting HTTP GET requests. Since bodyless GET requests bypass CakePHP CSRF validation, an attacker can trick an authenticated user with sufficient privileges into invoking the endpoint by loading a crafted URL. This results in the deletion of published empty events using skipBlocklist, which prevents the creation of blocklist entries and makes the deletion irreversible and untrackable during synchronization.

Recommendations Restrict the cullEmptyEvents action to HTTP POST requests to ensure CSRF protections are applied.