CVE-2026-85236 is a high severity cross-site request forgery flaw in MISP. The cullEmptyEvents action deleted published empty events when called with a GET request, so a privileged user loading a crafted URL could trigger it. The fix limits the action to POST. Update MISP to a build that includes it.
What's affected
- Product: MISP (misp-project), the
cullEmptyEventsaction. - Affected and fixed versions: the record names no release numbers. It points to five upstream commits (2b6b3ac90, 50106c9a0, 66ecb5acb, 9c1346ce1 and cfc8b8a6d). Check the MISP release notes to see which tag contains them.
- Condition: an authenticated user with enough privilege must load the crafted URL, for example through an embedded image.
Severity in the record: High, CVSS 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
Weakness class: CWE-352 (Cross-Site Request Forgery).
How to check if you're exposed
- Find your MISP version on the Diagnostics page in the web interface, or read the
VERSION.jsonfile in the install directory. - Look at the MISP releases and compare against the fix commits listed above. If your install tracks the main branch by git,
git log --onelinein the install directory will show whether those commits are present. - Check the logs for requests to
cullEmptyEventsthat came as GET requests, and for deletions of empty events that nobody on the team ran. - Confirm that event deletion would be recoverable. The record notes the deletion skips the blocklist, so the events leave no marker that would stop or track a later sync.
What to do now
- Update MISP to a release or commit that includes the POST only change, following the project's update steps.
- Take a backup of the database before updating, and test that it restores.
- Remind analysts with delete rights to avoid opening untrusted links while logged in to MISP.
- Review the sync configuration with partners so a missing event would be noticed.
- Keep MISP on a regular update schedule, since several issues in this release cycle touch authentication.
Why it matters
CakePHP, the framework under MISP, protects forms and POST requests with CSRF tokens. A GET request with no body does not go through that check. When a state changing action accepts GET, any web page can make the user's browser send it by loading an image. The weakness is CWE-352.
What raises the stakes is that the deletion is permanent in a quiet way. Because the action skips the blocklist, deleted events leave no blocklist entry to flag them during sync. For a threat intelligence platform, losing event records can mean losing evidence. The fix is simple: only accept POST, so the usual CSRF protection applies. The record does not mark this CVE as exploited in the wild.
Quick check
Does the record give a fixed MISP version?
No. It lists upstream commits only. Check MISP release notes for the tag that contains them.
Sources
Last reviewed: 18 October 2026.
