CVE-2026-91857

Affected versions of MISP expose several state-changing controller actions without restricting them to POST.

The affected actions are:

• EventReportsController::purgeUnusedPictures()

• NoticelistsController::enableNoticelist()

• ServersController::removeOrphanedCorrelations()

• WorkflowsController::rebuildRedis()

The patch adds allowMethod(['post']) to each action, preventing them from being triggered through ordinary GET requests.

For purgeUnusedPictures(), the corresponding UI previously used $.get(). The fix converts that request to POST and supplies X-CSRF-Token, while the controller enables header-only CSRF validation for that AJAX action.

Because GET requests can be induced cross-origin through links, images, redirects, or navigation, accepting GET for these state-changing operations can let an attacker trigger them using the authenticated victim's session.

Version affected: ≤2.5.45