Versions of the MISP cti‑transmute component expose several state‑changing operations via GET requests that still require authentication. Because the endpoints – /account/follow, /account/delete_notification, /account/mark_notification_read, and /account/mark_all_read – were susceptible to CSRF, an attacker could cause an authenticated user’s browser to perform those actions automatically. This flaw can lead to an unauthorized account following another user, deleting or marking notifications as read, or altering notification settings without the user’s consent, potentially impacting data integrity and privacy.

All installations of the MISP cti‑transmute component running a version prior to the commit c352c2329e48ccc33a2b96d5353450cfbf7e89ec are affected. The patch changes the vulnerable GET calls to POST or DELETE and adds CSRF token checks in the front‑end. The affected vendor is MISP, specifically the cti‑transmute module.

CVSS score for the flaw is 5.3, indicating moderate severity. EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The primary attack vector is CSRF via a third‑party web page; an attacker can trigger the vulnerable request without any interaction beyond visiting the page. Because no elevated privileges are necessary beyond the victim’s authenticated session, the impact is limited to the victim’s account. The lack of a high exploitation probability suggests a moderate but still meaningful risk, especially if the software is exposed to untrusted browsers or used by privileged users.