Vulnerability Description
Affected versions of MISP cti-transmute expose several state-changing account operations as GET requests: * /account/follow * /account/delete_notification * /account/mark_notification_read * /account/mark_all_read These endpoints require authentication, but before the fix they could be invoked with simple GET requests. That makes them susceptible to cross-site request forgery because a third-party site can induce the victim’s browser to send authenticated GET requests automatically. The patch converts the actions to POST or DELETE and updates the frontend to include an X-CSRFToken header, providing explicit CSRF protection for those state-changing operations.
Related Weaknesses (CWE)
References
FAQ
What is CVE-2026-73162?
CVE-2026-73162 is a documented vulnerability. Affected versions of MISP cti-transmute expose several state-changing account operations as GET requests: * /account/follow * /account/delete_notification * /account/mark_notificati...
How severe is CVE-2026-73162?
CVSS scoring is not yet available for CVE-2026-73162. Check NVD for updates.
Is there a patch for CVE-2026-73162?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.