CVE-2026-90893

MISP versions ≤2.5.45 contain a CSRF vulnerability in the UserSettingsController . The actions setTheme , setHomePage , and eventIndexColumnToggle were added to the Security component's unlockedActions list, disabling all CSRF token and field-hash validation for those endpoints. Because these acc...

CVE-2026-90893 MISP UserSettingsController CSRF Protection Bypass on setTheme, setHomePage, and eventIndexColumnToggle Endpoints

MISP contains a Cross-Site Request Forgery CSRF vulnerability in the UserSettingsController. The actions setTheme, setHomePage, and eventIndexColumnToggle were explicitly added to the Security component's unlockedActions list, which disabled all CSRF validation both token and field-hash checks fo...

EUVD-2026-77341

MISP contains a Cross-Site Request Forgery CSRF vulnerability in the UserSettingsController. The actions setTheme, setHomePage, and eventIndexColumnToggle were explicitly added to the Security component's unlockedActions list, which disabled all CSRF validation both token and field-hash checks fo...