CVE-2026-85236

A cross-site request forgery (CSRF) vulnerability existed in the cullEmptyEvents action of MISP. The endpoint performed a state-changing and irreversible operation while accepting HTTP GET requests. Because bodyless GET requests are not subject to CakePHP's CSRF validation, an attacker could cause an authenticated MISP user with sufficient privileges to invoke the endpoint simply by causing their browser to load a crafted URL, for example through an embedded image or other automatically requested resource. Successful exploitation triggers the deletion of published empty events. The deletion is particularly significant because the operation uses skipBlocklist, meaning the removed events do not leave blocklist entries that could prevent or track their subsequent synchronization. This can result in unintended and potentially irreversible deletion of MISP event records without explicit user interaction. The vulnerability was addressed by restricting cullEmptyEvents to HTTP POST requests, ensuring that CakePHP's normal CSRF protections are applied to the operation.

• CWE-352

• https://github.com/MISP/MISP/commit/2b6b3ac90Patch
• https://github.com/MISP/MISP/commit/50106c9a0Patch
• https://github.com/MISP/MISP/commit/66ecb5acbPatch
• https://github.com/MISP/MISP/commit/9c1346ce1Patch
• https://github.com/MISP/MISP/commit/cfc8b8a6dPatch

Published

Sep 3, 2026

Last Modified

Sep 11, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-85229** UNSUPPORTED WHEN ASSIGNED ** Improper neutralization of i…6.1
• CVE-2026-8523Use after free in Mojo in Google Chrome prior to 148.0.7778.…8.3
• CVE-2026-85230A persistent unsafe URL injection vulnerability exists in th…5.4
• CVE-2026-85231A flaw was found in libtirpc. An authenticated remote attack…6.5
• CVE-2026-85234A flaw was found in tftp-hpa. When the `in.tftpd` remap engi…7.5
• CVE-2026-85235The Forminator Forms – Contact Form, Payment Form & Custom F…7.2
• CVE-2026-85237A vulnerability in MISP's email-based one-time password (OTP…8.1
• CVE-2026-85238MISP contains a session fixation vulnerability in the Custom…6.8
• CVE-2026-85239A vulnerability in MISP's event template handling allowed an…6.5
• CVE-2026-8524Out of bounds write in WebAudio in Google Chrome prior to 14…8.8
• CVE-2026-85241A weakness has been identified in SpecterOps BloodHound up t…6.3
• CVE-2026-85242PlaywrightCapture contains a server-side request forgery (SS…6.9