CVE-2026-85546

MISP contains a cross-site request forgery (CSRF) vulnerability in the sharing group quick-edit functionality. The addOrg, removeOrg, addServer, and removeServer actions share the __initialiseSGQuickEdit() helper, where the HTTP method validation intended to restrict these operations to POST requests was commented out. As a result, these state-changing actions could be invoked using GET requests. An attacker could craft a URL targeting one of the affected actions and cause an authenticated MISP user with sufficient privileges to request it, for example through a malicious link or embedded web resource. Successful exploitation could modify the membership of a MISP sharing group without the victim intentionally performing the operation. Depending on the action performed, an attacker could add or remove organisations or servers from a sharing group, potentially granting unintended access to information distributed through that sharing group or disrupting legitimate information sharing. The patch restores HTTP method enforcement centrally in __initialiseSGQuickEdit() by calling allowMethod(['post']), ensuring that all four affected quick-edit operations require POST requests and are therefore subject to the application's normal protections for state-changing requests.

• CWE-352

• https://github.com/MISP/MISP/commit/3060d93cb

Published

Sep 4, 2026

Last Modified

Sep 4, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-85533An authorization flaw in MISP allowed an authenticated user …7.6
• CVE-2026-85534A flaw was found in libsoup. When a client sends an HTTP/2 r…5.9
• CVE-2026-85538An incorrect authorization vulnerability in MISP allowed aut…8.3
• CVE-2026-8554Type Confusion in ANGLE in Google Chrome on Windows prior to…3.1
• CVE-2026-85540DreamMaker developed by Interinfo has a SQL Injection vulner…8.8
• CVE-2026-85541DreamMaker developed by Interinfo has a Reflected Cross-site…5.4
• CVE-2026-85547A cross-site request forgery (CSRF) vulnerability exists in …6.2
• CVE-2026-8555Use after free in GTK in Google Chrome on Windows prior to 1…8.8
• CVE-2026-8556Inappropriate implementation in ANGLE in Google Chrome on Wi…3.1
• CVE-2026-8557Use after free in Accessibility in Google Chrome prior to 14…7.5
• CVE-2026-85577AVideo through commit c91b5975d contains a reflected cross-s…5.4
• CVE-2026-85578SiYuan through 3.8.1 contains an authorization bypass vulner…6.5