The MISP WorkflowsController exposed the moduleStatelessExecution action in the Security component's unlockedActions list, disabling the CSRF token check and field hash validation. An attacker can craft a cross‑site form post or equivalent request that an authenticated site administrator unknowingly submits, causing the administrator's browser to invoke the action and execute any workflow module with arbitrary input. This allows the attacker to modify integrity‑critical data such as blocklist and warninglist entries, constituting a high‑integrity CSRF vulnerability (CWE‑352).

MISP MISP applications running versions that include the vulnerable moduleStatelessExecution action are affected, specifically all releases prior to the fix included in MISP v2.5.47. Administrators of older MISP installations must verify that their deployment is not running this code path.

The vulnerability scores a CVSS of 6.9, indicating moderate severity, and although no EPSS score is published, the absence of a CSRF check means that exploitation requires an authenticated administrator and a malicious web page until the patch is applied. It is not listed in the CISA KEV catalog, but the ability to execute arbitrary workflow modules with elevated privileges makes it a significant risk. The attack vector is user‑initiated cross‑site request forgery leveraging an authenticated session, so ensuring the CSRF token is enforced and updating to the patched version substantially reduces that risk.