CVE-2026-73162
Severity CVSS v4.0:
MEDIUM
Type:
CWE-352
Cross-Site Request Forgery (CSRF)
Publication date:
11/08/2026
Last modified:
11/08/2026
Description
Affected versions of MISP cti-transmute expose several state-changing account operations as GET requests:<br />
<br />
<br />
<br />
* <br />
/account/follow<br />
<br />
<br />
* <br />
/account/delete_notification<br />
<br />
<br />
* <br />
/account/mark_notification_read<br />
<br />
<br />
* <br />
/account/mark_all_read<br />
<br />
<br />
<br />
<br />
<br />
These endpoints require authentication, but before the fix they could be invoked with simple GET requests. That makes them susceptible to cross-site request forgery because a third-party site can induce the victim’s browser to send authenticated GET requests automatically.<br />
<br />
<br />
The patch converts the actions to POST or DELETE and updates the frontend to include an X-CSRFToken header, providing explicit CSRF protection for those state-changing operations.
Impact
Base Score 4.0
5.30
Severity 4.0
MEDIUM