CVE-2026-85236

CVE-2026-85236 is a cross-site request forgery (CSRF) vulnerability in the cullEmptyEvents action of MISP, which performed an irreversible, state-changing deletion of published empty events while accepting HTTP GET requests. Because bodyless GET requests are exempt from CakePHP's CSRF validation, an attacker could cause any authenticated MISP user with sufficient privileges to trigger the deletion simply by getting their browser to load a crafted URL, such as through an embedded image. The impact is silent loss of published empty event records; because the deletion uses skipBlocklist, the removed events leave no blocklist entries, making the loss harder to track and potentially permanent across synchronization. Any organization running MISP whose privileged users browse untrusted web content is affected. There is no known exploitation in the wild and no public proof-of-concept, and the flaw is fixed by restricting the endpoint to HTTP POST so standard CSRF protections apply.

What to do: Update MISP to a release in which the cullEmptyEvents action is restricted to HTTP POST requests (no fixed version number is provided in the available data; check upstream MISP advisories for the patched release). Until patched, be cautious about relying on blocklist entries to track removals of empty events, and consider restricting who can reach the cullEmptyEvents endpoint. Because exploitation requires a privileged authenticated user to load attacker-controlled content, remind administrators to avoid browsing untrusted sites while authenticated to MISP.