GitHub Advisoryadvisory · PyPI

GHSA-j4rh-7jcr-qm69 misp-modules website - Missing CSRF protection in the website home blueprint

CRITICAL Published 2026-05-06 Modified 2026-05-14 Official page ↗
Aliases
CVE-2026-44364
Ecosystem
PyPI
Packages
misp-modules
Severity
Critical
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H
Weaknesses
CWE-352
Reviewed
2026-05-06

Affected packages

• PyPI misp-modules: <= 3.0.7 (no fix yet)

Description

A Cross-Site Request Forgery vulnerability in the MISP Modules website allowed an attacker to cause an authenticated user to submit unintended requests to the home endpoint. The vulnerability was due to the home blueprint being exempted from CSRF protection. This could allow modification of session query data in the context of the authenticated user. The issue was fixed by enabling CSRF protection for the affected blueprint and hardening query parsing. As reported by Bilal Teke.

Related

Alias · CVE (1)

  • CVE-2026-44364 MISP modules are autonomous modules that can be used to extend MISP for new services. vulnerability

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

References