An authenticated MISP user can bypass the sharing‑group authorization check by sending a PUT request to the /collections/add endpoint instead of the intended POST method. The CRUDComponent::add() operation persists data for both POST and PUT, but the authorisation guard in CollectionsController::add() was only applied to POST requests prior to the fix. This omission permits the creation of a collection with distribution=4 (shared with a specific sharing group) referencing a group the attacker is not authorized to use, thereby exposing that information to all members of the unauthorized group. The flaw manifests as an improper authorization control (CWE‑285) compounded by an improper privilege check (CWE‑862).

The vulnerability targets MISP, the open‑source threat intelligence platform. Any installation that has not applied the patch that extends the authorization guard in CollectionsController::add() to handle PUT requests remains vulnerable. No specific version numbers are listed in the CNA data, so the risk applies to all affected deployments until updated.

The CVSS score of 5.3 indicates medium severity. EPSS information is not available, so the statistical likelihood of exploitation is unquantified. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires only an authenticated session and knowledge of a valid sharing‑group identifier. The likely attack vector is via the web API, where an attacker sends a crafted PUT request to the same endpoint used for normal collection creation, bypassing the sharing‑group usability check.