CVE-2026-73162
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
Affected versions of MISP cti-transmute expose several state-changing account operations as GET requests, such as /account/follow, /account/delete_notification, /account/mark_notification_read, and /account/mark_all_read. These endpoints require authentication, but before the fix they could be invoked with simple GET requests, making them susceptible to cross-site request forgery. The patch converts the actions to POST or DELETE and updates the frontend to include an X-CSRFToken header.
Risk Assessment
An attacker can trick a victim's browser into performing unauthorized account operations, such as deleting notifications or changing follow status, without user consent.
Recommendation
Update cti-transmute to a version containing the fix that enforces POST/DELETE methods and CSRF header for these operations.
Original NVD description (English source)
Affected versions of MISP cti-transmute expose several state-changing account operations as GET requests: * /account/follow * /account/delete_notification * /account/mark_notification_read * /account/mark_all_read These endpoints require authentication, but before the fix they could be invoked with simple GET requests. That makes them susceptible to cross-site request forgery because a third-party site can induce the victim’s browser to send authenticated GET requests automatically. The patch converts the actions to POST or DELETE and updates the frontend to include an X-CSRFToken header, providing explicit CSRF protection for those state-changing operations.