{"id":"CVE-2026-85546","title":"MISP contains a cross-site request forgery (CSRF) vulnerability in the sharing group quick-edit functionality","summary":"MISP contains a cross-site request forgery (CSRF) vulnerability in the sharing group quick-edit functionality. The addOrg, removeOrg, addServer, and removeServer actions share the __initialiseSGQuickEdit() helper, where the HTTP method v…","severity":"high","cvss":8.6,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:L/SA:N","cwe":["CWE-352"],"vendor":"misp","product":"misp","affected":["misp <= 2.4.45"],"published":"2026-09-04","updated":"2026-09-10","sourceUpdated":"2026-09-10T08:17:01.553","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85546","references":[{"url":"https://github.com/MISP/MISP/commit/3060d93cb","label":"5a6e4751-2f3f-4070-9419-94fb35b644e8"}],"tags":["nvd","cve.org"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-09-04T19:35:24.607798Z"},"cvssSource":"cna","epss":0.00198,"epssPercentile":0.09914,"ingestedAt":"2026-09-08T15:33:26.960Z","slug":"CVE-2026-85546","body":"## Overview\n\nMISP contains a cross-site request forgery (CSRF) vulnerability in the sharing group quick-edit functionality. The addOrg, removeOrg, addServer, and removeServer actions share the __initialiseSGQuickEdit() helper, where the HTTP method validation intended to restrict these operations to POST requests was commented out.\n\nAs a result, these state-changing actions could be invoked using GET requests. An attacker could craft a URL targeting one of the affected actions and cause an authenticated MISP user with sufficient privileges to request it, for example through a malicious link or embedded web resource.\n\nSuccessful exploitation could modify the membership of a MISP sharing group without the victim intentionally performing the operation. Depending on the action performed, an attacker could add or remove organisations or servers from a sharing group, potentially granting unintended access to information distributed through that sharing group or disrupting legitimate information sharing.\n\nThe patch restores HTTP method enforcement centrally in __initialiseSGQuickEdit() by calling allowMethod(['post']), ensuring that all four affected quick-edit operations require POST requests and are therefore subject to the application's normal protections for state-changing requests.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":47,"depthScoreParts":{"impact":47.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":202037,"id":"CVE-2026-85546","ts":1789400046591,"field":"cvss","old":null,"new":"8.6"},{"seq":202036,"id":"CVE-2026-85546","ts":1789400046591,"field":"severity","old":"none","new":"high"},{"seq":200764,"id":"CVE-2026-85546","ts":1789397615148,"field":"cvss","old":"8.6","new":null},{"seq":200763,"id":"CVE-2026-85546","ts":1789397615148,"field":"severity","old":"high","new":"none"},{"seq":199459,"id":"CVE-2026-85546","ts":1789395514246,"field":"cvss","old":null,"new":"8.6"},{"seq":199458,"id":"CVE-2026-85546","ts":1789395514246,"field":"severity","old":"none","new":"high"},{"seq":198704,"id":"CVE-2026-85546","ts":1789392242691,"field":"cvss","old":"8.6","new":null},{"seq":198703,"id":"CVE-2026-85546","ts":1789392242691,"field":"severity","old":"high","new":"none"},{"seq":197037,"id":"CVE-2026-85546","ts":1789384291086,"field":"cvss","old":null,"new":"8.6"},{"seq":197036,"id":"CVE-2026-85546","ts":1789384291086,"field":"severity","old":"none","new":"high"},{"seq":194166,"id":"CVE-2026-85546","ts":1789378781850,"field":"cvss","old":"8.6","new":null},{"seq":194165,"id":"CVE-2026-85546","ts":1789378781850,"field":"severity","old":"high","new":"none"},{"seq":192953,"id":"CVE-2026-85546","ts":1789376513632,"field":"cvss","old":null,"new":"8.6"},{"seq":192952,"id":"CVE-2026-85546","ts":1789376513632,"field":"severity","old":"none","new":"high"},{"seq":191740,"id":"CVE-2026-85546","ts":1789373629870,"field":"cvss","old":"8.6","new":null},{"seq":191739,"id":"CVE-2026-85546","ts":1789373629870,"field":"severity","old":"high","new":"none"},{"seq":190525,"id":"CVE-2026-85546","ts":1789369472526,"field":"cvss","old":null,"new":"8.6"},{"seq":190524,"id":"CVE-2026-85546","ts":1789369472526,"field":"severity","old":"none","new":"high"},{"seq":189312,"id":"CVE-2026-85546","ts":1789368407738,"field":"cvss","old":"8.6","new":null},{"seq":189311,"id":"CVE-2026-85546","ts":1789368407738,"field":"severity","old":"high","new":"none"},{"seq":188095,"id":"CVE-2026-85546","ts":1789365229293,"field":"cvss","old":null,"new":"8.6"},{"seq":188094,"id":"CVE-2026-85546","ts":1789365229293,"field":"severity","old":"none","new":"high"},{"seq":186882,"id":"CVE-2026-85546","ts":1789363470060,"field":"cvss","old":"8.6","new":null},{"seq":186881,"id":"CVE-2026-85546","ts":1789363470060,"field":"severity","old":"high","new":"none"},{"seq":185668,"id":"CVE-2026-85546","ts":1789361227546,"field":"cvss","old":null,"new":"8.6"},{"seq":185667,"id":"CVE-2026-85546","ts":1789361227546,"field":"severity","old":"none","new":"high"},{"seq":184455,"id":"CVE-2026-85546","ts":1789358362369,"field":"cvss","old":"8.6","new":null},{"seq":184454,"id":"CVE-2026-85546","ts":1789358362369,"field":"severity","old":"high","new":"none"},{"seq":182706,"id":"CVE-2026-85546","ts":1789354315703,"field":"cvss","old":null,"new":"8.6"},{"seq":182705,"id":"CVE-2026-85546","ts":1789354315703,"field":"severity","old":"none","new":"high"},{"seq":181499,"id":"CVE-2026-85546","ts":1789353316418,"field":"cvss","old":"8.6","new":null},{"seq":181498,"id":"CVE-2026-85546","ts":1789353316418,"field":"severity","old":"high","new":"none"},{"seq":180292,"id":"CVE-2026-85546","ts":1789350283349,"field":"cvss","old":null,"new":"8.6"},{"seq":180291,"id":"CVE-2026-85546","ts":1789350283349,"field":"severity","old":"none","new":"high"},{"seq":179085,"id":"CVE-2026-85546","ts":1789348291650,"field":"cvss","old":"8.6","new":null},{"seq":179084,"id":"CVE-2026-85546","ts":1789348291650,"field":"severity","old":"high","new":"none"},{"seq":177878,"id":"CVE-2026-85546","ts":1789346368617,"field":"cvss","old":null,"new":"8.6"},{"seq":177877,"id":"CVE-2026-85546","ts":1789346368617,"field":"severity","old":"none","new":"high"},{"seq":176671,"id":"CVE-2026-85546","ts":1789343182057,"field":"cvss","old":"8.6","new":null},{"seq":176670,"id":"CVE-2026-85546","ts":1789343182057,"field":"severity","old":"high","new":"none"},{"seq":174788,"id":"CVE-2026-85546","ts":1789334874279,"field":"cvss","old":null,"new":"8.6"},{"seq":174787,"id":"CVE-2026-85546","ts":1789334874279,"field":"severity","old":"none","new":"high"},{"seq":173583,"id":"CVE-2026-85546","ts":1789333685507,"field":"cvss","old":"8.6","new":null},{"seq":173582,"id":"CVE-2026-85546","ts":1789333685507,"field":"severity","old":"high","new":"none"},{"seq":172397,"id":"CVE-2026-85546","ts":1789331091621,"field":"cvss","old":null,"new":"8.6"},{"seq":172396,"id":"CVE-2026-85546","ts":1789331091621,"field":"severity","old":"none","new":"high"},{"seq":171211,"id":"CVE-2026-85546","ts":1789328779645,"field":"cvss","old":"8.6","new":null},{"seq":171210,"id":"CVE-2026-85546","ts":1789328779645,"field":"severity","old":"high","new":"none"},{"seq":170006,"id":"CVE-2026-85546","ts":1789327195772,"field":"cvss","old":null,"new":"8.6"},{"seq":170005,"id":"CVE-2026-85546","ts":1789327195772,"field":"severity","old":"none","new":"high"}]}