How to fix or mitigate CVE-2026-44364?

Within 24 hours, inventory all systems running misp-modules and determine their current version status. Within 7 days, apply the vendor-released patch by upgrading to misp-modules version 3.0.8 or later across all affected systems. Within 30 days, verify patch deployment is complete and confirm CSRF protection is properly enabled on all Flask blueprints through security testing or code review.

CVE-2026-44364

Q: What is the CVSS score of CVE-2026-44364?

CVE-2026-44364 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

CRITICAL

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-05-06 https://github.com/MISP/misp-modules

GHSA-j4rh-7jcr-qm69

CSRF

9.3

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 23, 2026 - 23:08 vuln.today

Analysis Generated

Jul 23, 2026 - 23:08 vuln.today

CVSS changed

May 13, 2026 - 20:22 NVD

9.3 (CRITICAL)

CVE Published

May 06, 2026 - 22:31 github-advisory

CRITICAL 9.3

CVE Published

May 06, 2026 - 22:31 nvd

CRITICAL

DescriptionGitHub Advisory

A Cross-Site Request Forgery vulnerability in the MISP Modules website allowed an attacker to cause an authenticated user to submit unintended requests to the home endpoint. The vulnerability was due to the home blueprint being exempted from CSRF protection. This could allow modification of session query data in the context of the authenticated user. The issue was fixed by enabling CSRF protection for the affected blueprint and hardening query parsing. As reported by Bilal Teke.

AnalysisAI

Cross-Site Request Forgery in the MISP Modules website (pip package misp-modules <= 3.0.7) lets an attacker trick an authenticated user's browser into submitting forged requests to the home endpoint, modifying that user's session query data. The flaw stems from the home blueprint being explicitly exempted from Flask's CSRF protection (csrf.exempt(home_blueprint)). No public exploit identified at time of analysis, and EPSS is very low (0.02%, 5th percentile), consistent with a CSRF issue that requires a targeted, socially-engineered click rather than mass exploitation.