The vulnerability arises from a broken HTTP method check in MISP’s sharing group quick‑edit helper; as a result, state‑changing actions can be triggered by GET requests. An attacker can craft a malicious URL that an authenticated user will follow, causing the user to add or remove organisations or servers from a sharing group without their knowledge. This changes the membership and therefore the data that the group distributes, potentially exposing sensitive information to unintended parties or disrupting legitimate sharing. The weakness is a CSRF flaw (CWE‑352) that permits unauthorized change of data integrity.

MISP, any installation using the default code base where the shared quick‑edit functionality exists. No specific version is listed; the issue is present in all builds before the official patch that re‑enables POST‑only enforcement in the helper function.

The CVSS score of 8.6 classifies the vulnerability as high severity. The EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no known exploitation in the wild yet. However, CSRF requirements are satisfied on any Web‑enabled MISP instance, providing an attack surface that an attacker could exploit with an enticing link or embedded resource. Successful exploitation requires an authenticated user with group‑management privileges; the attacker remains a legitimate user but the action performed without consent. The risk is therefore moderate to high for organizations that rely on sharing groups for secure information distribution.