https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 10:12:00 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-366062 EUVD-2026-366062 https://cve.radiocsirt.org/vuln/euvd-2026-366062 https://cve.radiocsirt.org/vuln/fkie_cve-2026-85546 <p>MISP contains a cross-site request forgery (CSRF) vulnerability in the sharing group quick-edit functionality. The addOrg, removeOrg, addServer, and removeServer actions share the __initialiseSGQuickEdit() helper, where the HTTP method validation intended to restrict these operations to POST requests was commented out.</p> <p>As a result, these state-changing actions could be invoked using GET requests. An attacker could craft a URL targeting one of the affected actions and cause an authenticated MISP user with sufficient privileges to request it, for example through a malicious link or embedded web resource.</p> <p>Successful exploitation could modify the membership of a MISP sharing group without the victim intentionally performing the operation. Depending on the action performed, an attacker could add or remove organisations or servers from a sharing group, potentially granting unintended access to information distributed through that sharing group or disrupting legitimate information sharing.</p> <p>The patch restores HTTP method enforcement centrally in __initialiseSGQuickEdit() by calling allowMethod([&#39;post&#39;]), ensuring that all four affected quick-edit operations require POST requests and are therefore subject to the application&#39;s normal protections for state-changing requests.</p> <p>MISP contains a cross-site request forgery (CSRF) vulnerability in the sharing group quick-edit functionality. The addOrg, removeOrg, addServer, and removeServer actions share the __initialiseSGQuickEdit() helper, where the HTTP method validation intended to restrict these operations to POST requests was commented out.</p> <p>As a result, these state-changing actions could be invoked using GET requests. An attacker could craft a URL targeting one of the affected actions and cause an authenticated MISP user with sufficient privileges to request it, for example through a malicious link or embedded web resource.</p> <p>Successful exploitation could modify the membership of a MISP sharing group without the victim intentionally performing the operation. Depending on the action performed, an attacker could add or remove organisations or servers from a sharing group, potentially granting unintended access to information distributed through that sharing group or disrupting legitimate information sharing.</p> <p>The patch restores HTTP method enforcement centrally in __initialiseSGQuickEdit() by calling allowMethod([&#39;post&#39;]), ensuring that all four affected quick-edit operations require POST requests and are therefore subject to the application&#39;s normal protections for state-changing requests.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-85546 https://cve.radiocsirt.org/vuln/ghsa-cwc4-rgpg-99q3 <p>MISP contains a cross-site request forgery (CSRF) vulnerability in the sharing group quick-edit functionality. The addOrg, removeOrg, addServer, and removeServer actions share the __initialiseSGQuickEdit() helper, where the HTTP method validation intended to restrict these operations to POST requests was commented out.</p> <p>As a result, these state-changing actions could be invoked using GET requests. An attacker could craft a URL targeting one of the affected actions and cause an authenticated MISP user with sufficient privileges to request it, for example through a malicious link or embedded web resource.</p> <p>Successful exploitation could modify the membership of a MISP sharing group without the victim intentionally performing the operation. Depending on the action performed, an attacker could add or remove organisations or servers from a sharing group, potentially granting unintended access to information distributed through that sharing group or disrupting legitimate information sharing.</p> <p>The patch restores HTTP method enforcement centrally in __initialiseSGQuickEdit() by calling allowMethod([&#39;post&#39;]), ensuring that all four affected quick-edit operations require POST requests and are therefore subject to the application&#39;s normal protections for state-changing requests.</p> <p>MISP contains a cross-site request forgery (CSRF) vulnerability in the sharing group quick-edit functionality. The addOrg, removeOrg, addServer, and removeServer actions share the __initialiseSGQuickEdit() helper, where the HTTP method validation intended to restrict these operations to POST requests was commented out.</p> <p>As a result, these state-changing actions could be invoked using GET requests. An attacker could craft a URL targeting one of the affected actions and cause an authenticated MISP user with sufficient privileges to request it, for example through a malicious link or embedded web resource.</p> <p>Successful exploitation could modify the membership of a MISP sharing group without the victim intentionally performing the operation. Depending on the action performed, an attacker could add or remove organisations or servers from a sharing group, potentially granting unintended access to information distributed through that sharing group or disrupting legitimate information sharing.</p> <p>The patch restores HTTP method enforcement centrally in __initialiseSGQuickEdit() by calling allowMethod([&#39;post&#39;]), ensuring that all four affected quick-edit operations require POST requests and are therefore subject to the application&#39;s normal protections for state-changing requests.</p> https://cve.radiocsirt.org/vuln/ghsa-cwc4-rgpg-99q3 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-3173 <p>Ein Angreifer kann mehrere Schwachstellen in MISP ausnutzen, um Sicherheitsmechanismen zu umgehen, Informationen offenzulegen, Daten oder Sitzungen zu manipulieren und die Verfügbarkeit zu beeinträchtigen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in MISP ausnutzen, um Sicherheitsmechanismen zu umgehen, Informationen offenzulegen, Daten oder Sitzungen zu manipulieren und die Verfügbarkeit zu beeinträchtigen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-3173