{"id":"CVE-2026-42551","aliases":["GHSA-vxrr-w42w-w76g"],"url":"https://o3.security/vulnerability/CVE-2026-42551","summary":"Flight: HTTP method override enabled by default enables CSRF escalation and middleware bypass in flightphp/core","details":"### Summary\n`Request::getMethod()` unconditionally honors the `X-HTTP-Method-Override` header and the `$_REQUEST['_method']` parameter on **any** HTTP verb (including safe verbs such as GET), with no opt-in and no whitelist of permitted target methods. A GET request can silently become a DELETE or PUT, enabling CSRF escalation against destructive endpoints, bypass of middleware gated on unsafe verbs, and cache poisoning between CDN and origin.\n\n### Affected code\n`flight/net/Request.php` (≈ lines 281-292):\n\n```php\npublic static function getMethod(): string\n{\n    $method = self::getVar('REQUEST_METHOD', 'GET');\n    if (self::getVar('HTTP_X_HTTP_METHOD_OVERRIDE') !== '') {\n        $method = self::getVar('HTTP_X_HTTP_METHOD_OVERRIDE');\n    } elseif (isset($_REQUEST['_method']) === true) {\n        $method = $_REQUEST['_method'];\n    }\n    return strtoupper($method);\n}\n```\n\n`$_REQUEST` aggregates `$_GET` and `$_POST`; on PHP runtimes with `request_order=GPC` it also includes `$_COOKIE`.\n\n### Proof of concept\n```\nGET /item/42?_method=DELETE        HTTP/1.1\n```\nis dispatched as `DELETE /item/42`.\n\n```\nGET /item/42                       HTTP/1.1\nX-HTTP-Method-Override: DELETE\n```\nis also dispatched as `DELETE /item/42`.\n\nTrivial CSRF vector (no JavaScript required):\n```html\n<img src=\"https://victim.tld/item/42?_method=DELETE\">\n```\nloaded on any attacker-controlled page triggers the destructive DELETE on page load, bypassing Same-Origin Policy (image loads are not blocked).\n\nReproduced against `/poc4/item/42`.\n\n### Impact\n- GET → DELETE / PUT CSRF on any route registered for unsafe verbs.\n- Bypass of authentication, CSRF token, or rate-limiting middleware that is gated only on POST/DELETE.\n- CDN cache poisoning: the CDN caches the GET response body while the origin executed a DELETE.\n\n### Patch (fixed in `3.18.1`, commit `b8dd23a`)\nA new `flight.allow_method_override` setting controls both override vectors. Operators can set it to `false` to disable `X-HTTP-Method-Override` and `_method` entirely.\n\n### Credit\nDiscovered by **@Rootingg**.","published":"2026-05-13T19:23:27.314Z","modified":"2026-08-12T03:51:21.493559844Z","cvss":{"score":7.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"},"epss":{"score":0.0031,"percentile":0.23087,"asOf":"2026-08-24"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"flightphp/core","fixedVersion":"3.18.1"}],"fix":{"url":"https://github.com/flightphp/core/commit/b8dd23aaa828cb289fa3c84e75b2a3717cab50b0","label":"flightphp/core@b8dd23a"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42551.json"},{"type":"ADVISORY","url":"https://github.com/flightphp/core/security/advisories/GHSA-vxrr-w42w-w76g"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42551"},{"type":"WEB","url":"https://github.com/flightphp/core/commit/b8dd23aaa828cb289fa3c84e75b2a3717cab50b0"},{"type":"PACKAGE","url":"https://github.com/flightphp/core"},{"type":"WEB","url":"https://github.com/flightphp/core/releases/tag/v3.18.1"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:21.493559844Z"}}