CVE-2026-90893

MISP contains a Cross-Site Request Forgery (CSRF) vulnerability in the UserSettingsController. The actions setTheme, setHomePage, and eventIndexColumnToggle were explicitly added to the Security component's unlockedActions list, which disabled all CSRF validation (both token and field-hash checks) for those endpoints. Because these endpoints accept POST requests and modify per-user application state (theme selection, default homepage URL, and event index column visibility), an attacker who can induce a logged-in MISP user to load a malicious page (e.g., via a crafted link, embedded image, or auto-submitting form) can forge requests that alter the victim's settings without their knowledge or consent. The most impactful action is setHomePage, which allows an attacker to redirect the victim's default landing page to an arbitrary attacker-controlled URL, potentially facilitating phishing or further social engineering. The setTheme action can alter the user's visual theme, and eventIndexColumnToggle can change which columns are displayed in the event index view. No authentication bypass is involved; the victim must already be authenticated to MISP. The vulnerability was reported by the Scottish Government National Cyber Team. Version affected: ≤2.5.45

• CWE-352

• https://github.com/MISP/MISP/commit/979337b18

Published

Sep 14, 2026

Last Modified

Sep 16, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-9088A flaw was found in org.keycloak.services. An administrator …2.7
• CVE-2026-90880A security flaw has been discovered in D-Link DSL-3782 2016-…7.4
• CVE-2026-90881A weakness has been identified in D-Link DIR-882 up to 20260…5.3
• CVE-2026-9089The ConnectWise Automate™ Agent does not fully verify the au…8.8
• CVE-2026-90890ASRock Polychrome SYNC/RGB software utility developed by ASR…5.5
• CVE-2026-90891ASRock Polychrome SYNC/RGB software utility developed by ASR…5.5
• CVE-2026-90894Parallels Desktop runs prl_disp_service as root. Local clien…7.8
• CVE-2026-90895Affected versions of MISP’s interactive CLI shell implement …8.4
• CVE-2026-90896Missing Authentication for Critical Function (CWE-306) in th…8.2
• CVE-2026-90898Bifrost registers MCP clients through its management API. A …9.8
• CVE-2026-9090Casdoor versions 2.362.0 and earlier contain a vulnerability…9.1
• CVE-2026-9091Casdoor versions 2.362.0 and earlier contain a logic flaw in…5.3