CVE-2026-90893

MISP contains a Cross-Site Request Forgery CSRF vulnerability in the UserSettingsController. The actions setTheme, setHomePage, and eventIndexColumnToggle were explicitly added to the Security component's unlockedActions list, which disabled all CSRF validation both token and field-hash checks fo...

CVE-2026-90893 MISP UserSettingsController CSRF Protection Bypass on setTheme, setHomePage, and eventIndexColumnToggle Endpoints

MISP contains a Cross-Site Request Forgery CSRF vulnerability in the UserSettingsController. The actions setTheme, setHomePage, and eventIndexColumnToggle were explicitly added to the Security component's unlockedActions list, which disabled all CSRF validation both token and field-hash checks fo...

CVE-2026-90893 MISP UserSettingsController CSRF Protection Bypass on setTheme, setHomePage, and eventIndexColumnToggle Endpoints

MISP contains a Cross-Site Request Forgery CSRF vulnerability in the UserSettingsController. The actions setTheme, setHomePage, and eventIndexColumnToggle were explicitly added to the Security component's unlockedActions list, which disabled all CSRF validation both token and field-hash checks fo...

CVE-2026-90893

MISP versions ≤2.5.45 contain a CSRF vulnerability in the UserSettingsController . The actions setTheme , setHomePage , and eventIndexColumnToggle were added to the Security component's unlockedActions list, disabling all CSRF token and field-hash validation for those endpoints. Because these acc...

EUVD-2026-77341

MISP contains a Cross-Site Request Forgery CSRF vulnerability in the UserSettingsController. The actions setTheme, setHomePage, and eventIndexColumnToggle were explicitly added to the Security component's unlockedActions list, which disabled all CSRF validation both token and field-hash checks fo...

CVE-2026-90893 MISP UserSettingsController CSRF Protection Bypass on setTheme, setHomePage, and eventIndexColumnToggle Endpoints

MISP contains a Cross-Site Request Forgery CSRF vulnerability in the UserSettingsController. The actions setTheme, setHomePage, and eventIndexColumnToggle were explicitly added to the Security component's unlockedActions list, which disabled all CSRF validation both token and field-hash checks fo...

PT-2026-91126

MISP contains a Cross-Site Request Forgery CSRF vulnerability in the UserSettingsController. The actions setTheme, setHomePage, and eventIndexColumnToggle were explicitly added to the Security component's unlockedActions list, which disabled all CSRF validation both token and field-hash checks fo...

CVE-2026-49249 Boruta: Authenticated atom-exhaustion DoS in BorutaIdentityWeb.UserSettingsController.update/2

Boruta is a standalone authorization server that aims to implement OAuth 2.0 and Openid Connect up to decentralized identity specifications. Prior to version 0.10.0, BorutaIdentityWeb.UserSettingsController.update/2 atomizes every key of the user-supplied request body via String.toatom/1 before a...

EUVD-2026-70240

Boruta is a standalone authorization server that aims to implement OAuth 2.0 and Openid Connect up to decentralized identity specifications. Prior to version 0.10.0, BorutaIdentityWeb.UserSettingsController.update/2 atomizes every key of the user-supplied request body via String.toatom/1 before a...

EUVD-2023-45866

Malicious code in bioql PyPI...

CVE-2023-41363

In Cerebrate 1.14, a vulnerability in UserSettingsController allows authenticated users to change user settings of other users...

Design/Logic Flaw

In Cerebrate 1.14, a vulnerability in UserSettingsController allows authenticated users to change user settings of other users...

CVE-2023-41363

CVE-2023-41363 affects Cerebrate 1.14, in the UserSettingsController. Affected component: UserSettingsController in Cerebrate; vulnerability allows an authenticated low-privilege user to change other users’ settings with no user interaction. CVSS 3.1: 4.3 (MEDIUM); AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L...

CVE-2023-41363

In Cerebrate 1.14, a vulnerability in UserSettingsController allows authenticated users to change user settings of other users...

CVE-2023-41363

In Cerebrate 1.14, a vulnerability in UserSettingsController allows authenticated users to change user settings of other users...

CVE-2023-41363

In Cerebrate 1.14, a vulnerability in UserSettingsController allows authenticated users to change user settings of other users...

PT-2023-27927 · Cerebrate · Cerebrate

Name of the Vulnerable Software and Affected Versions: Cerebrate version 1.14 Description: A vulnerability in the UserSettingsController allows authenticated users to change user settings of other users. Recommendations: For Cerebrate version 1.14, consider restricting access to the...

CVE-2020-24085

A cross-site scripting XSS vulnerability exists in MISP v2.4.128 in app/Controller/UserSettingsController.php at SetHomePage function. Due to a lack of controller validation in "path" parameter, an attacker can execute malicious JavaScript code...