CVE-2026-73162

Affected versions of MISP cti-transmute expose several state-changing account operations as GET requests: * /account/follow * /account/delete_notification * /account/mark_notification_read * /account/mark_all_read These endpoints require authentication, but before the fix they could be invoked with simple GET requests. That makes them susceptible to cross-site request forgery because a third-party site can induce the victim’s browser to send authenticated GET requests automatically. The patch converts the actions to POST or DELETE and updates the frontend to include an X-CSRFToken header, providing explicit CSRF protection for those state-changing operations.

Score

CVSS 4.0 5.3 Medium

Status

Deferred - 5a6e4751-2f3f-4070-9419-94fb35b644e8

Published

2026-08-11

Last modified

2026-10-24

Weaknesses

CWE-352

Affected products

• Cti-transmute (Misp)

References

• https://github.com/MISP/cti-transmute/commit/c352c2329e48ccc33a2b96d5353450cfbf7e89ec