CVE-2026-42551: Flight HTTP Method Override Enabled By Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-vxrr-w42w-w76g",
  "modified" : "2026-05-14T20:40:04Z",
  "published" : "2026-05-06T21:38:16Z",
  "aliases" : [ "CVE-2026-42551" ],
  "summary" : "Flight: HTTP method override enabled by default, facilitating CSRF escalation and middleware bypass",
  "details" : "### Summary\n`Request::getMethod()` unconditionally honors the `X-HTTP-Method-Override` header and the `$_REQUEST['_method']` parameter on **any** HTTP verb (including safe verbs such as GET), with no opt-in and no whitelist of permitted target methods. A GET request can silently become a DELETE or PUT, enabling CSRF escalation against destructive endpoints, bypass of middleware gated on unsafe verbs, and cache poisoning between CDN and origin.\n\n### Affected code\n`flight/net/Request.php` (≈ lines 281-292):\n\n```php\npublic static function getMethod(): string\n{\n    $method = self::getVar('REQUEST_METHOD', 'GET');\n    if (self::getVar('HTTP_X_HTTP_METHOD_OVERRIDE') !== '') {\n        $method = self::getVar('HTTP_X_HTTP_METHOD_OVERRIDE');\n    } elseif (isset($_REQUEST['_method']) === true) {\n        $method = $_REQUEST['_method'];\n    }\n    return strtoupper($method);\n}\n```\n\n`$_REQUEST` aggregates `$_GET` and `$_POST`; on PHP runtimes with `request_order=GPC` it also includes `$_COOKIE`.\n\n### Proof of concept\n```\nGET /item/42?_method=DELETE        HTTP/1.1\n```\nis dispatched as `DELETE /item/42`.\n\n```\nGET /item/42                       HTTP/1.1\nX-HTTP-Method-Override: DELETE\n```\nis also dispatched as `DELETE /item/42`.\n\nTrivial CSRF vector (no JavaScript required):\n```html\n<img src=\"https://victim.tld/item/42?_method=DELETE\">\n```\nloaded on any attacker-controlled page triggers the destructive DELETE on page load, bypassing Same-Origin Policy (image loads are not blocked).\n\nReproduced against `/poc4/item/42`.\n\n### Impact\n- GET → DELETE / PUT CSRF on any route registered for unsafe verbs.\n- Bypass of authentication, CSRF token, or rate-limiting middleware that is gated only on POST/DELETE.\n- CDN cache poisoning: the CDN caches the GET response body while the origin executed a DELETE.\n\n### Patch (fixed in `3.18.1`, commit `b8dd23a`)\nA new `flight.allow_method_override` setting controls both override vectors. Operators can set it to `false` to disable `X-HTTP-Method-Override` and `_method` entirely.\n\n### Credit\nDiscovered by **@Rootingg**.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "flightphp/core"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "3.18.1"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/flightphp/core/security/advisories/GHSA-vxrr-w42w-w76g"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-42551"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/flightphp/core/commit/b8dd23aaa828cb289fa3c84e75b2a3717cab50b0"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/flightphp/core"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/flightphp/core/releases/tag/v3.18.1"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-436" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-05-06T21:38:16Z",
    "nvd_published_at" : "2026-05-13T20:16:22Z"
  }
}