The flaw lies in MISP’s editField action, which fails to enforce the framework’s standard CSRF protection. An attacker can host a malicious web page that, when visited by an authenticated user, silently submits a forged request to editField, allowing the attacker to alter attribute details such as value, type, category, comment, distribution settings, or timestamps. This gives the attacker unauthorized modification of threat‑intelligence data, potentially corrupting indicators, misclassifying events, and eroding confidence in the platform.

All installations of MISP running a version earlier than 2.5.47 are impacted. The affected component is the editField endpoint exposed without CSRF validation for authenticated sessions in MISP: MISP.

The CVSS score of 7.1 indicates high impact with medium‑high exploitability. The attack vector is browser‑based CSRF: the victim must be logged in and visit an attacker‑controlled page. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog. The patch removes editField from the unlockedActions list, enforcing CSRF token validation via the X‑CSRF‑Token header or request body, thereby eliminating the existing attack path.