A CSRF flaw exists in MISP where the application disables form‑security checks when it detects a REST request. Because the REST test can be manipulated through request properties such as the URL suffix or the HTTP Accept header, an attacker can trick MISP into treating a cross‑origin request as a REST call and thereby skip CSRF validation. The vulnerability allows an unauthenticated attacker to coerce an authenticated user to visit a malicious page that issues state‑changing requests under the victim's authenticated session, enabling the attacker to create, modify, publish or delete MISP data.

All unpatched MISP installations are potentially vulnerable. The official vendor entry lists the product as "misp:misp" with no specific release failures; thus any MISP release that has not incorporated the grafted safeguard is at risk.

The CVSS score of 6.2 indicates moderate severity, and EPSS data is unavailable. The vulnerability is listed neither in KEV nor in other widely recognized exploitation registries. The likely attack vector is a cross‑origin web page that supplies an Accept: application/json header, or a crafted URL suffix, to make MISP believe the traffic is an authenticated REST request. An attacker would need the victim to be logged in to a MISP session for the exploit to succeed, after which the attacker could perform unauthorized data changes if the target user’s permissions allow it.