CVE-2026-73162

Affected versions of MISP cti-transmute expose several state-changing account operations as GET requests:



  *  
/account/follow


  *  
/account/delete_notification


  *  
/account/mark_notification_read


  *  
/account/mark_all_read





These endpoints require authentication, but before the fix they could be invoked with simple GET requests. That makes them susceptible to cross-site request forgery because a third-party site can induce the victim’s browser to send authenticated GET requests automatically.


The patch converts the actions to POST or DELETE and updates the frontend to include an X-CSRFToken header, providing explicit CSRF protection for those state-changing operations.