CVE-2026-95674
Deferred Deferred - Pending Action

MISP Module Bypass via Unvalidated Enrichment Request

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: CIRCL

Description
In MISP, the queryEnrichment method in EventsController.php accepted a module name parameter and iterated over the list of enabled modules to find a match. If the specified module was not present in the enabled modules list, the code silently continued processing using default parameters (format set to 'simplified' and no module-specific configuration applied) rather than rejecting the request. This allowed an authenticated user to trigger enrichment or analysis processing through a module that was not explicitly enabled or available on the instance, bypassing the intended module availability controls. The lack of validation meant that module names outside the enabled set were not rejected, potentially exposing functionality or data processing paths that the administrator had not authorized for use.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-22
Last Modified
2026-09-22
Generated
2026-09-22
AI Q&A
2026-09-22
EPSS Evaluated
N/A
NVD
CVE-2026-95674
EUVD
EUVD-2026-84392

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
misp misp *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in MISP allows an authenticated user to bypass module availability controls by requesting a module that is not enabled on the instance. The system silently processes the request using default parameters instead of rejecting it, potentially exposing unauthorized functionality or data processing paths.

Detection Guidance

Check MISP logs for unauthorized module queries or enrichment attempts. Review EventsController.php for instances where module names are passed without validation. Look for MethodNotAllowedException errors indicating module access attempts.

Impact Analysis

An attacker with access could exploit this to trigger enrichment or analysis using modules not approved by the administrator, potentially leading to unauthorized data processing, information leakage, or misuse of system resources.

Compliance Impact

This vulnerability could lead to unauthorized data processing or sharing, violating principles of data minimization and purpose limitation under GDPR. For HIPAA, it may result in impermissible disclosures of protected health information if unauthorized modules process sensitive data.

Mitigation Strategies

Update MISP to the patched version that includes the module validation check in EventsController.php. Ensure only enabled modules are accessible and monitor for unauthorized enrichment requests.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-95674. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart