Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-ndeh-dr3m-mkgq
Vulnerability ID VCID-ndeh-dr3m-mkgq
Aliases CVE-2026-44364
GHSA-j4rh-7jcr-qm69
Summary MISP modules are autonomous modules that can be used to extend MISP for new services. In 3.0.7 and earlier, a Cross-Site Request Forgery vulnerability in the MISP Modules website allowed an attacker to cause an authenticated user to submit unintended requests to the home endpoint. The vulnerability was due to the home blueprint being exempted from CSRF protection. This could allow modification of session query data in the context of the authenticated user. The issue was fixed by enabling CSRF protection for the affected blueprint and hardening query parsing.
Status Published
Exploitability 0.5
Weighted Severity 9.0
Risk 4.5
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-352 Cross-Site Request Forgery (CSRF)
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 8e-05 https://api.first.org/data/v1/epss?cve=CVE-2026-44364
epss 8e-05 https://api.first.org/data/v1/epss?cve=CVE-2026-44364
cvssv3.1_qr CRITICAL https://github.com/advisories/GHSA-j4rh-7jcr-qm69
cvssv4 9.3 https://github.com/MISP/misp-modules
generic_textual CRITICAL https://github.com/MISP/misp-modules
cvssv4 9.3 https://github.com/MISP/misp-modules/commit/52cda9caa003cafe87e14ae3721db5e16f6f111a
generic_textual CRITICAL https://github.com/MISP/misp-modules/commit/52cda9caa003cafe87e14ae3721db5e16f6f111a
cvssv3.1_qr CRITICAL https://github.com/MISP/misp-modules/security/advisories/GHSA-j4rh-7jcr-qm69
cvssv4 9.3 https://github.com/MISP/misp-modules/security/advisories/GHSA-j4rh-7jcr-qm69
generic_textual CRITICAL https://github.com/MISP/misp-modules/security/advisories/GHSA-j4rh-7jcr-qm69
ssvc Track https://github.com/MISP/misp-modules/security/advisories/GHSA-j4rh-7jcr-qm69
cvssv4 9.3 https://nvd.nist.gov/vuln/detail/CVE-2026-44364
generic_textual CRITICAL https://nvd.nist.gov/vuln/detail/CVE-2026-44364
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2026-44364
https://github.com/MISP/misp-modules
https://github.com/MISP/misp-modules/commit/52cda9caa003cafe87e14ae3721db5e16f6f111a
https://nvd.nist.gov/vuln/detail/CVE-2026-44364
GHSA-j4rh-7jcr-qm69 https://github.com/advisories/GHSA-j4rh-7jcr-qm69
GHSA-j4rh-7jcr-qm69 https://github.com/MISP/misp-modules/security/advisories/GHSA-j4rh-7jcr-qm69
No exploits are available.
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H Found at https://github.com/MISP/misp-modules
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H Found at https://github.com/MISP/misp-modules/commit/52cda9caa003cafe87e14ae3721db5e16f6f111a
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H Found at https://github.com/MISP/misp-modules/security/advisories/GHSA-j4rh-7jcr-qm69
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-05-14T16:19:31Z/ Found at https://github.com/MISP/misp-modules/security/advisories/GHSA-j4rh-7jcr-qm69
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H Found at https://nvd.nist.gov/vuln/detail/CVE-2026-44364
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.00709
EPSS Score 8e-05
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T16:42:42.270965+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2026/44xxx/CVE-2026-44364.json 38.6.0