MISP EUVD-2026-84371

Exploitation requires an authenticated MISP administrator to have an active session and to be induced to submit an attacker-crafted cross-site form or cross-origin request (UI:A) while the vulnerable moduleStatelessExecution action remains listed in the Security component's unlockedActions (pre-v2.5.47 default state). The attacker needs no MISP credentials of their own (PR:N) and can freely choose which workflow module runs and its input/parameters, but the endpoint only executes workflow modules - so impact is confined to actions those modules perform (writing blocklist/warninglist entries), not arbitrary code execution. Limiting factors: victim must be an authenticated admin and must interact with attacker content; instances patched to v2.5.47 (which restores the CSRF check via X-CSRF-Token header) are not affected.

This is a genuine but moderate-priority integrity flaw, not an inflated high-CVSS finding. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N) is internally consistent with a classic CSRF: network-reachable, low complexity, no attacker privileges, but requiring victim interaction (UI:A) and delivering integrity-only impact (VI:H) with no confidentiality or availability loss. The real-world risk is bounded by two factors the raw 6.9 score already reflects: exploitation depends on socially engineering an authenticated MISP administrator into submitting an attacker-controlled cross-origin request, and the damage is limited to writing security-relevant data (blocklist/warninglist entries) rather than code execution or data theft. No EPSS score, no CISA KEV listing, and no public exploit are present in the input - the flaw was found in an internal CIRCL security review and was not externally reported, so exploitation status is 'no public exploit identified at time of analysis.' There are no conflicting signals: description, CVSS vector (PR:N unauthenticated attacker relying on the victim's admin session), and CWE-352 all align. The main caveat is that impact severity depends on how much the target organization relies on MISP blocklist/warninglist integrity for downstream automated decisions.

An attacker hosts a malicious web page containing an auto-submitting cross-site form (or equivalent cross-origin POST) targeting the MISP instance's moduleStatelessExecution endpoint. When an authenticated MISP administrator visits that page while logged in, their browser silently invokes the action, executing an attacker-chosen workflow module - such as one that writes blocklist or warninglist entries - with attacker-supplied input and parameters. No public exploit code exists; the issue was found in an internal CIRCL review, though the mechanism is straightforward given the missing CSRF protection.