CVE-2026-91819

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-91819
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-91819.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-91819
Published
2026-09-15T07:41:37Z
Modified
2026-09-17T03:47:27Z
Severity
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
MISP: HTTP Method Override Bypasses CSRF and Form Validation in BetterSecurityComponent
Details

Affected versions of MISP rely on CakePHP request-method override processing in a way that can disable CSRF and form-security validation.

CakePHP honors a _method field or X-HTTP-Method-Override header by rewriting the effective request method. For override values outside the normal write verbs POST, PUT, PATCH, and DELETE, CakePHP also clears the parsed request body. MISP’s security component then determines whether to perform _validatePost() and _validateCsrf() based on whether request data remains. With a value such as:

_method=GET

the body becomes empty before those checks run, so both protections are skipped. A cross-site form containing only that override can therefore reach actions whose parameters are taken from the URL rather than the request body

Version affected: ≤2.5.45

Database specific 
{
    "cna_assigner": "CIRCL",
    "cwe_ids": [
        "CWE-20",
        "CWE-352"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91819.json"
}
References

Affected packages

Git / github.com/misp/misp

Affected ranges

Type
GIT
Repo
https://github.com/misp/misp
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
29af008c4
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.5.46"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-91819.json"