What is CVE-2026-73162?
MISP cti-transmute incorrectly exposes state-changing account operations (like follow, delete/mark notifications) as GET requests. While authentication is required, this design flaw could allow authenticated users to perform unauthorized actions via CSRF attacks. Developers should change these endpoints to POST/PUT methods or implement anti-CSRF tokens.
Azərbaycanca: MISP cti-transmute proqramında bir neçə hesab əməliyyatı (izləmə, bildiriş silmə) GET sorğuları kimi səhv konfiqurasiya edilib. Bu, autentifikasiya olunmuş istifadəçilərə CSRF hücumları vasitəsilə icazəsiz əməliyyatlar etməyə imkan verə bilər. Tərtibatçılar bu endpoint-ləri POST/PUT sorğularına dəyişdirməli və ya anti-CSRF token-lər əlavə etməlidir.
Related CVEs
link basis: same weakness class CWE-352
FAQ2
In MISP cti-transmute, what is the core configuration flaw that makes account operations (like follow, delete notification) vulnerable to CSRF attacks?
The account operations are incorrectly exposed as GET requests. For security, such state-changing endpoints should use POST or PUT methods, or implement anti-CSRF tokens.
What is the required authentication status for an attacker to exploit the CSRF vulnerability in MISP cti-transmute?
The vulnerability affects authenticated users, meaning the victim must be logged into MISP. Although authentication is required, the flaw still allows unauthorized account operations via CSRF.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.