A missing CSRF protection check in the home blueprint of MISP modules allows an attacker to craft a request that executes with the credentials of any authenticated user who visits a malicious page. The flaw permits the attacker to submit arbitrary requests to the home endpoint, potentially altering session query data and influencing subsequent actions performed by the compromised user.

The vulnerability affects the MISP modules library from the MISP project, specifically versions 3.0.7 and earlier. It resides in the website component that renders the modules user interface rather than the core MISP server itself.

The CVSS score of 9.3 signals a high severity flaw that can result in unauthorized data modification. The EPSS score is not available, and the flaw is not listed in the CISA KEV catalog. Exploitation requires that the victim is already authenticated; an attacker can induce the user to open a crafted URL or click a link, causing the malicious request to be sent automatically. Because the home endpoint lacks CSRF validation, the attack does not need additional technical barriers, making it straightforward for attackers who can trick victims into visiting malicious content.