CVE Intelligence
Analysis AI-assisted

CVE-2026-44364: MISP Modules website - Missing CSRF protection in home blueprint

A Cross-Site Request Forgery flaw in the MISP Modules website affects versions 3.0.7 and earlier. The home blueprint was exempt from CSRF protection, which could let an attacker cause an authenticated user to send unintended requests. The record rates it critical (CVSS 4.0 score 9.3) and does not list it in CISA KEV.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

This record describes a Cross-Site Request Forgery issue (CWE-352) in the MISP Modules website. According to the GitHub advisory cited in the record, the home blueprint was exempt from CSRF protection. The fix enabled CSRF protection for that blueprint and hardened query parsing.

Impact

The record states that an attacker could cause an authenticated user to submit unintended requests to the home endpoint. This could allow modification of session query data in the context of that user. The CVSS 4.0 base score recorded is 9.3 (critical). The vector in the record requires high privileges (PR:H) and user interaction (UI:P), and shows high confidentiality, integrity and availability impact on the vulnerable system.

Affected products and versions

  • Product: MISP Misp-modules
  • Affected: version 3.0.7 and earlier, as stated in the record.
  • Fixed version: no fixed version number appears in the record's fix list. The advisory describes the remediation, so consult it for the release that contains the fix.

Exploitation status

This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. No confirmed exploitation in the wild appears in the sources consulted. The SSVC fields in the record show exploitation as none and automatable as no. The EPSS probability recorded is 0.00207, with a percentile of 0.10057.

Remediation and mitigation

  • Update MISP Modules to a release that includes the fix described in the GitHub advisory.
  • Until the update is applied, restrict access to the MISP Modules website to trusted networks and users.
  • Ask users of MISP to sign out when finished and to avoid following untrusted links while logged in.

Detection guidance

  • Review web server and application logs for unexpected requests to the home endpoint, especially those with external referrers.
  • Watch for unexpected changes to session-related query data.

Limitations of the available information

The record does not give a fixed version number or a full list of affected endpoints beyond the home blueprint. The EPSS date in the record (2026-10-13) is later than the publication date (2026-05-13), so the EPSS values should be checked against the current feed before use.

Frequently asked questions

Which versions of MISP Modules are affected by CVE-2026-44364?

The record states that version 3.0.7 and earlier are affected. Check the GitHub advisory for the exact fixed release.

Is this vulnerability known to be exploited in the wild?

CISA KEV does not list this CVE, and no confirmed exploitation appears in the sources consulted. The SSVC exploitation field in the record is none.

What is the root cause?

According to the record, the home blueprint was exempt from CSRF protection. The fix enabled CSRF protection for that blueprint and hardened query parsing.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.