CVE-2026-73162
Gravedad CVSS v4.0:
MEDIA
Tipo:
CWE-352
Falsificación de petición en sitios cruzados (Cross-Site Request Forgery)
Fecha de publicación:
11/08/2026
Última modificación:
11/08/2026
Descripción
*** Pendiente de traducción *** Affected versions of MISP cti-transmute expose several state-changing account operations as GET requests:<br />
<br />
<br />
<br />
* <br />
/account/follow<br />
<br />
<br />
* <br />
/account/delete_notification<br />
<br />
<br />
* <br />
/account/mark_notification_read<br />
<br />
<br />
* <br />
/account/mark_all_read<br />
<br />
<br />
<br />
<br />
<br />
These endpoints require authentication, but before the fix they could be invoked with simple GET requests. That makes them susceptible to cross-site request forgery because a third-party site can induce the victim’s browser to send authenticated GET requests automatically.<br />
<br />
<br />
The patch converts the actions to POST or DELETE and updates the frontend to include an X-CSRFToken header, providing explicit CSRF protection for those state-changing operations.
Impacto
Puntuación base 4.0
5.30
Gravedad 4.0
MEDIA