CVE-2026-85547

Name of the Vulnerable Software and Affected Versions MISP (affected versions not specified)

Description A cross-site request forgery (CSRF) issue occurs because the system disables form-security and CSRF protections if a request is identified as REST traffic. This detection can be manipulated by an attacker using the HTTP Accept header (e.g., Accept: application/json), which can be sent from a cross-origin page without a CORS preflight. Consequently, the system may treat a request from a malicious website as REST traffic and bypass security validations while using the victim's authenticated browser session. An attacker could trick an authenticated user into visiting a malicious page to execute unauthorized state-changing requests to susceptible endpoints, potentially leading to the unauthorized modification, creation, publication, or removal of data. The issue stems from the isRest() function granting security exemptions based on request type rather than the authentication mechanism.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.