CVE-2026-85546

MISP, the open-source threat intelligence sharing platform, contains a cross-site request forgery vulnerability (CWE-352) in the sharing group quick-edit functionality. The addOrg, removeOrg, addServer, and removeServer actions share the __initialiseSGQuickEdit() helper, in which the HTTP method validation restricting these operations to POST was commented out, so an attacker can trigger them with crafted GET requests. By luring an authenticated MISP user with sufficient privileges to a malicious link or embedded web resource, an attacker can silently add or remove organisations or servers from a sharing group, potentially granting unintended access to intelligence distributed through that group or disrupting legitimate sharing. All MISP deployments are plausibly affected; the source data does not specify affected version ranges or the fixed version. Exploitation is currently theoretical: no public PoC, no CISA KEV listing, and EPSS puts 30-day exploitation probability at 0.2%.

What to do: Upgrade MISP to a release that restores HTTP method enforcement in __initialiseSGQuickEdit() (allowMethod(['post'])), since no specific fixed version is given in the source data, check your vendor channel or repository for the patched release. As interim mitigation, review sharing group membership for unexpected organisations or servers, and monitor logs for GET requests hitting the addOrg/removeOrg/addServer/removeServer quick-edit endpoints. Avoid clicking untrusted links while authenticated to MISP with sharing-group administration privileges.