A mass‑assignment flaw in the sharing group creation endpoint allows an authenticated user with permission to add sharing groups to include a primary key in the payload. CakePHP then updates that existing record instead of creating a new one, bypassing the normal edit access‑control checks. The attacker can therefore take over or alter sharing groups they do not otherwise have access to, compromising the confidentiality and integrity of information shared through those groups.

The vulnerability affects the MISP platform, specifically its sharing group creation logic in the SharingGroupsController add() action. No specific version information is supplied, so any MISP installation running the unpatched code is susceptible.

The CVSS score of 8.4 indicates high severity. Detailed EPSS data is unavailable, but the lack of a KEV listing suggests no widespread exploitation has been confirmed. Nonetheless, because the attack requires only authentication and the relatively common permission to create sharing groups, the likelihood of exploitation is significant for organizations that grant such privileges broadly. The risk is therefore moderate to high, especially for environments where sharing groups contain sensitive data.