CVE-2026-85546

MISP contains a cross-site request forgery (CSRF) vulnerability in the sharing group quick-edit functionality. The addOrg, removeOrg, addServer, and removeServer actions share the __initialiseSGQuickEdit() helper, where the HTTP method validation intended to restrict these operations to POST requests was commented out. As a result, these state-changing actions could be invoked using GET requests. An attacker could craft a URL targeting one of the affected actions and cause an authenticated MISP user with sufficient privileges to request it, for example through a malicious link or embedded web resource. Successful exploitation could modify the membership of a MISP sharing group without the victim intentionally performing the operation. Depending on the action performed, an attacker could add or remove organisations or servers from a sharing group, potentially granting unintended access to information distributed through that sharing group or disrupting legitimate information sharing. The patch restores HTTP method enforcement centrally in __initialiseSGQuickEdit() by calling allowMethod(['post']), ensuring that all four affected quick-edit operations require POST requests and are therefore subject to the application's normal protections for state-changing requests.

• CWE-352

• https://github.com/MISP/MISP/commit/3060d93cb

Published

Sep 4, 2026

Last Modified

Sep 10, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-85540DreamMaker developed by Interinfo has a SQL Injection vulner…8.8
• CVE-2026-85541DreamMaker developed by Interinfo has a Reflected Cross-site…5.4
• CVE-2026-85542IBM Guardium Data Protection 12.2 is affected by a command i…8.8
• CVE-2026-85543Some Wi-Fi series camera products have insufficient permissi…4.3
• CVE-2026-85544Some Hikvision intercom products utilize an immutable factor…6.1
• CVE-2026-85545There is an Vulnerability in some HikCentral Access Control …7.1
• CVE-2026-85547A cross-site request forgery (CSRF) vulnerability exists in …6.2
• CVE-2026-8555Use after free in GTK in Google Chrome on Windows prior to 1…8.8
• CVE-2026-8556Inappropriate implementation in ANGLE in Google Chrome on Wi…3.1
• CVE-2026-85568The Unlimited Elements for Elementor WordPress plugin before…6.8
• CVE-2026-85569The Tutor LMS WordPress plugin before 4.0.8 does not correc…7.2
• CVE-2026-8557Use after free in Accessibility in Google Chrome prior to 14…7.5