CVE-2026-54359

CVE-2026-54359

MISP contains an insecure default configuration in which the Security.check_sec_fetch_site_header control is disabled. When this setting is disabled, state-changing requests such as POST, PUT, or AJAX requests are not restricted based on t…

Vulnerability class: CSRF (Cross-Site Request Forgery)

Weakness classification (CWE)

References