A high-severity cross-site request forgery vulnerability in MISP allows an attacker to manipulate sharing group memberships, potentially leading to unauthorized data access or disruption of information sharing.

This vulnerability occurs because HTTP method validation was omitted in the __initialiseSGQuickEdit() helper function. An attacker can use a crafted GET request to trigger state-changing actions, such as adding or removing organizations or servers from a sharing group, when performed by an authenticated user with sufficient privileges.

Successful exploitation allows an attacker to alter the distribution of sensitive intelligence by modifying sharing group membership. Given the CVSS score of 8.6, this flaw poses a significant risk to the integrity and confidentiality of shared information. Unauthorized changes to these groups can lead to data leaks or the intentional disruption of critical collaborative threat intelligence workflows.

Immediate Action: Upgrade to a version of MISP beyond 2.4.54 where the HTTP method enforcement is restored, or apply the upstream fix commit 3060d93cb.

Proactive Monitoring: Review web access logs for unusual GET requests targeting organization or server management endpoints, especially those originating from unexpected referrers.

Compensating Controls: Implement strict Web Application Firewall rules to block GET requests directed at administrative or management endpoints that perform state-changing operations.

Public Exploit Available: No — exploit_available is unknown.

The severity of this vulnerability necessitates immediate attention to prevent unauthorized administrative modifications within MISP. Organizations should verify their current version and apply the vendor-provided patch as soon as possible to ensure that sharing group configurations remain protected against CSRF-based manipulation.