GCVE-1-2026-20102 (CVE-2026-91819)
Vulnerability from gna-1 – Published: 2026-09-15 07:41 – Updated: 2026-09-15 07:41
VLAI
EPSS
VEX
Title
MISP: HTTP Method Override Bypasses CSRF and Form Validation in BetterSecurityComponent
Summary
Affected versions of MISP rely on CakePHP request-method override processing in a way that can disable CSRF and form-security validation.
CakePHP honors a _method field or X-HTTP-Method-Override header by rewriting the effective request method. For override values outside the normal write verbs POST, PUT, PATCH, and DELETE, CakePHP also clears the parsed request body. MISP’s security component then determines whether to perform _validatePost() and _validateCsrf() based on whether request data remains. With a value such as:
_method=GET
the body becomes empty before those checks run, so both protections are skipped. A cross-site form containing only that override can therefore reach actions whose parameters are taken from the URL rather than the request body
Version affected: ≤2.5.45
Severity
Assigner
GNA-1
This instance
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/MISP/MISP/commit/29af008c4 | patch |
Impacted products
GCVE extensions
AI-generated
Confidence: medium
Model
qwen3.8:27b
advisory
bcp-05-x-01bcp-05-x-02
AI involvement
GCVE-BCP-05-X-01
Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.
ai-computer-assisted:llm-generatedai-computer-assisted:classification
| Model | Source | Identifier |
|---|---|---|
| qwen3.8:27b | ollama | qwen3.8:27b |
Patch provenance
GCVE-BCP-05-X-02
- Generator
-
patch2vuln.pyon 2026-09-15 07:32 - Model
qwen3.8:27b- Input
-
https://github.com/MISP/MISP/commit/29af008c4.patch
97161c8af547… - Confidence
- medium
| Commit | Subject | Patch SHA-256 |
|---|---|---|
29af008c47d2
|
fix: [security] Refuse HTTP method overrides that empty the | 97161c8af547… |
Fix summary
The fix introduces a __rejectUnsafeMethodOverride() check in BetterSecurityComponent::startup() that executes before the parent SecurityComponent::startup() computes $hasData. It inspects both the _method POST field and the X-HTTP-Method-Override header (mirroring CakePHP's precedence) and rejects any value that is not a string in the allowed set {POST, PUT, PATCH, DELETE}. Non-string values (e.g., array payloads like _method[]=GET) are also refused. A BadRequestException is thrown and the event is logged, preventing the request from ever reaching the parent security logic with an emptied body.
Patch summary
Adds a private __rejectUnsafeMethodOverride() method and a public startup() override to BetterSecurityComponent. The new method reads $_POST['_method'] and the HTTP_X_HTTP_METHOD_OVERRIDE header, applies the same header-over-body precedence as CakeRequest::_processPost(), and throws BadRequestException for any override that is not a string in the ALLOWED_METHOD_OVERRIDES constant (POST, PUT, PATCH, DELETE). The startup() override calls this check before delegating to parent::startup(). A new test file BetterSecurityComponentTest.php (196 lines) covers pass-through of write verbs, refusal of non-write verbs, non-string overrides, header overrides, header-over-body precedence, and log output.
CVSS rationale
AV:N: The attack is delivered over the network via a crafted HTML form or HTTP header. AC:L: Exploitation requires only crafting a form with a _method field; no race conditions or complex timing are needed. AT:N: No manipulation of the target's data or state is required prior to the attack. PR:L: The victim must be an authenticated MISP user; no administrative privileges are needed. UI:P: The victim passively interacts with the attack (e.g., visiting a page with an auto-submitting form); no deliberate action beyond page load is required. VC:N: No confidentiality impact is evident from the patch evidence. VI:H: The attacker can perform arbitrary state-changing actions (enable/disable feeds, modify objects) on the victim's MISP instance, representing high integrity impact. VA:N: No availability impact is indicated. SC/SI/SA:N: No sub-component impact is evidenced.
Weakness rationale
- CWE-352 The primary security impact is the complete bypass of CSRF token validation. An attacker can forge requests to state-changing MISP endpoints without a valid CSRF token by exploiting the method-override body-emptying behaviour.
- CWE-20 The root cause is the failure to validate the _method override value before it influences the security component's behaviour. Any verb outside the expected write set is accepted by the framework and causes the request body to be discarded, disabling security checks.
Assumptions to verify
- The fix is included in MISP v2.5.46 based on the tag_version_boundary metadata (228 commits after the fix commit at that tag); the exact affected version range prior to the fix is not explicitly stated in the patch.
- PR:L assumes the victim must be an authenticated MISP user; the patch does not explicitly state authentication requirements, but MISP is an authenticated threat-intelligence platform and the example endpoint (/feeds/enable/2) implies an authenticated context.
- UI:P assumes the typical CSRF delivery mechanism (auto-submitting form on a malicious page) where the victim's interaction is limited to loading the page; if a manual form submission is required, UI:A would be more appropriate.
- The vulnerability was found during internal review and was not externally reported, per the commit message.
Model comparison
Selected qwen3.8:27b
by deterministic-consensus-v1
The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required.
| Model | Score | Agreement | Confidence | Assumptions |
|---|---|---|---|---|
qwen3.8:27b |
6 | 9 | medium | 4 |
{
"containers": {
"cna": {
"affected": [
{
"modules": [
"app/Controller/Component/BetterSecurityComponent.php"
],
"product": "MISP",
"programFiles": [
"app/Controller/Component/BetterSecurityComponent.php"
],
"repo": "https://github.com/MISP/MISP",
"vendor": "MISP",
"versions": [
{
"lessThan": "2.5.46",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "remediation developer",
"value": "iglocska"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Claude Opus 5 (1M context)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003c/p\u003e\u003cp\u003eAffected versions of MISP rely on CakePHP request-method override processing in a way that can disable CSRF and form-security validation.\u003c/p\u003e\u003cp\u003eCakePHP honors a \u003ccode\u003e_method\u003c/code\u003e field or \u003ccode\u003eX-HTTP-Method-Override\u003c/code\u003e header by rewriting the effective request method. For override values outside the normal write verbs \u003ccode\u003ePOST\u003c/code\u003e, \u003ccode\u003ePUT\u003c/code\u003e, \u003ccode\u003ePATCH\u003c/code\u003e, and \u003ccode\u003eDELETE\u003c/code\u003e, CakePHP also clears the parsed request body. MISP\u2019s security component then determines whether to perform \u003ccode\u003e_validatePost()\u003c/code\u003e and \u003ccode\u003e_validateCsrf()\u003c/code\u003e based on whether request data remains. With a value such as:\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003e_method=GET\u003c/code\u003e\u003c/p\u003e\u003cp\u003ethe body becomes empty before those checks run, so both protections are skipped. A cross-site form containing only that override can therefore reach actions whose parameters are taken from the URL rather than the request body\u003c/p\u003e\u003cp\u003eVersion affected: \u22642.5.45\u003cbr\u003e\u003c/p\u003e"
}
],
"value": "Affected versions of MISP rely on CakePHP request-method override processing in a way that can disable CSRF and form-security validation.\n\nCakePHP honors a _method field or X-HTTP-Method-Override header by rewriting the effective request method. For override values outside the normal write verbs POST, PUT, PATCH, and DELETE, CakePHP also clears the parsed request body. MISP\u2019s security component then determines whether to perform _validatePost() and _validateCsrf() based on whether request data remains. With a value such as:\n\n\n_method=GET\n\nthe body becomes empty before those checks run, so both protections are skipped. A cross-site form containing only that override can therefore reach actions whose parameters are taken from the URL rather than the request body\n\nVersion affected: \u22642.5.45"
}
],
"impacts": [
{
"capecId": "CAPEC-62",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-62 Cross Site Request Forgery"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "CWE-352 Cross-Site Request Forgery (CSRF)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20 Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"orgId": "00000000-0000-4000-9000-000000000000"
},
"references": [
{
"name": "Security patch",
"tags": [
"patch"
],
"url": "https://github.com/MISP/MISP/commit/29af008c4"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe fix introduces a __rejectUnsafeMethodOverride() check in BetterSecurityComponent::startup() that executes before the parent SecurityComponent::startup() computes $hasData. It inspects both the _method POST field and the X-HTTP-Method-Override header (mirroring CakePHP\u0027s precedence) and rejects any value that is not a string in the allowed set {POST, PUT, PATCH, DELETE}. Non-string values (e.g., array payloads like _method[]=GET) are also refused. A BadRequestException is thrown and the event is logged, preventing the request from ever reaching the parent security logic with an emptied body.\u003c/p\u003e"
}
],
"value": "The fix introduces a __rejectUnsafeMethodOverride() check in BetterSecurityComponent::startup() that executes before the parent SecurityComponent::startup() computes $hasData. It inspects both the _method POST field and the X-HTTP-Method-Override header (mirroring CakePHP\u0027s precedence) and rejects any value that is not a string in the allowed set {POST, PUT, PATCH, DELETE}. Non-string values (e.g., array payloads like _method[]=GET) are also refused. A BadRequestException is thrown and the event is logged, preventing the request from ever reaching the parent security logic with an emptied body."
}
],
"title": "MISP: HTTP Method Override Bypasses CSRF and Form Validation in BetterSecurityComponent",
"x_gcve": [
{
"extensions": {
"bcp-05-x-01": {
"ai_annotations": [
{
"ai_level": "generated",
"description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
"gna_source": 1,
"models": [
{
"gna_source": 1,
"identifier": "qwen3.8:27b",
"name": "qwen3.8:27b",
"source": "ollama"
}
],
"review_status": "review",
"scope": "record",
"tags": [
"ai-computer-assisted:llm-generated",
"ai-computer-assisted:classification"
]
}
]
},
"bcp-05-x-02": {
"x_patch2vuln": {
"assumptions": [
"The fix is included in MISP v2.5.46 based on the tag_version_boundary metadata (228 commits after the fix commit at that tag); the exact affected version range prior to the fix is not explicitly stated in the patch.",
"PR:L assumes the victim must be an authenticated MISP user; the patch does not explicitly state authentication requirements, but MISP is an authenticated threat-intelligence platform and the example endpoint (/feeds/enable/2) implies an authenticated context.",
"UI:P assumes the typical CSRF delivery mechanism (auto-submitting form on a malicious page) where the victim\u0027s interaction is limited to loading the page; if a manual form submission is required, UI:A would be more appropriate.",
"The vulnerability was found during internal review and was not externally reported, per the commit message."
],
"commit": "29af008c47d2cc021b6183a0f119b36c8eabfe65",
"confidence": "medium",
"credits": [
{
"lang": "en",
"type": "remediation developer",
"value": "iglocska"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Claude Opus 5 (1M context)"
}
],
"cvssRationale": "AV:N: The attack is delivered over the network via a crafted HTML form or HTTP header. AC:L: Exploitation requires only crafting a form with a _method field; no race conditions or complex timing are needed. AT:N: No manipulation of the target\u0027s data or state is required prior to the attack. PR:L: The victim must be an authenticated MISP user; no administrative privileges are needed. UI:P: The victim passively interacts with the attack (e.g., visiting a page with an auto-submitting form); no deliberate action beyond page load is required. VC:N: No confidentiality impact is evident from the patch evidence. VI:H: The attacker can perform arbitrary state-changing actions (enable/disable feeds, modify objects) on the victim\u0027s MISP instance, representing high integrity impact. VA:N: No availability impact is indicated. SC/SI/SA:N: No sub-component impact is evidenced.",
"draft": false,
"fixSummary": "The fix introduces a __rejectUnsafeMethodOverride() check in BetterSecurityComponent::startup() that executes before the parent SecurityComponent::startup() computes $hasData. It inspects both the _method POST field and the X-HTTP-Method-Override header (mirroring CakePHP\u0027s precedence) and rejects any value that is not a string in the allowed set {POST, PUT, PATCH, DELETE}. Non-string values (e.g., array payloads like _method[]=GET) are also refused. A BadRequestException is thrown and the event is logged, preventing the request from ever reaching the parent security logic with an emptied body.",
"generatedAt": "2026-09-15T07:32:05.818714Z",
"generator": "patch2vuln.py",
"model": "qwen3.8:27b",
"modelComparison": {
"rankings": [
{
"agreementScore": 9,
"assumptionCount": 4,
"confidence": "medium",
"model": "qwen3.8:27b",
"score": 6
}
],
"selectedModel": "qwen3.8:27b",
"selectionMethod": "deterministic-consensus-v1",
"selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
},
"patchSha256": "97161c8af5472e6169868d916a2e4834f382a4e1f7c8efda555ea396171b8d3a",
"patchSummary": "Adds a private __rejectUnsafeMethodOverride() method and a public startup() override to BetterSecurityComponent. The new method reads $_POST[\u0027_method\u0027] and the HTTP_X_HTTP_METHOD_OVERRIDE header, applies the same header-over-body precedence as CakeRequest::_processPost(), and throws BadRequestException for any override that is not a string in the ALLOWED_METHOD_OVERRIDES constant (POST, PUT, PATCH, DELETE). The startup() override calls this check before delegating to parent::startup(). A new test file BetterSecurityComponentTest.php (196 lines) covers pass-through of write verbs, refusal of non-write verbs, non-string overrides, header overrides, header-over-body precedence, and log output.",
"patchTruncated": false,
"patches": [
{
"commit": "29af008c47d2cc021b6183a0f119b36c8eabfe65",
"patchSha256": "97161c8af5472e6169868d916a2e4834f382a4e1f7c8efda555ea396171b8d3a",
"source": "https://github.com/MISP/MISP/commit/29af008c4.patch",
"sourceUrl": "https://github.com/MISP/MISP/commit/29af008c4.patch",
"subject": "fix: [security] Refuse HTTP method overrides that empty the"
}
],
"source": "https://github.com/MISP/MISP/commit/29af008c4.patch",
"subject": "fix: [security] Refuse HTTP method overrides that empty the",
"tagVersionBoundary": {
"commits_after_fix": 228,
"repository": "https://github.com/MISP/MISP",
"tag": "v2.5.46",
"version": "2.5.46",
"version_type": "semver"
},
"weaknessRationale": [
{
"cweId": "CWE-352",
"rationale": "The primary security impact is the complete bypass of CSRF token validation. An attacker can forge requests to state-changing MISP endpoints without a valid CSRF token by exploiting the method-override body-emptying behaviour."
},
{
"cweId": "CWE-20",
"rationale": "The root cause is the failure to validate the _method override value before it influences the security component\u0027s behaviour. Any verb outside the expected write set is accepted by the framework and causes the request body to be discarded, disabling security checks."
}
]
}
}
},
"recordType": "advisory",
"vulnId": "GCVE-1-2026-20102"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "00000000-0000-4000-9000-000000000000",
"cveId": "CVE-2026-91819",
"datePublished": "2026-09-15T07:41:19.838478Z",
"dateReserved": "2026-09-15T07:41:29.630Z",
"dateUpdated": "2026-09-15T07:41:29.964690Z",
"state": "PUBLISHED",
"vulnId": "gcve-1-2026-20102"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…