CVE-2026-95674: MISP EventsController queryEnrichment allows querying unavailable or legacy modules without validation
In MISP, the queryEnrichment method in EventsController.php accepted a module name parameter and iterated over the list of enabled modules to find a match. If the specified module was not present in the enabled modules list, the code silently continued processing using default parameters (format set to 'simplified' and no module-specific configuration applied) rather than rejecting the request. This allowed an authenticated user to trigger enrichment or analysis processing through a module that was not explicitly enabled or available on the instance, bypassing the intended module availability controls. The lack of validation meant that module names outside the enabled set were not rejected, potentially exposing functionality or data processing paths that the administrator had not authorized for use.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In MISP EventsController.php, update queryEnrichment to track a moduleFound flag that is set only when the requested module matches an enabled module, and throw MethodNotAllowedException with 'Module not found or not available' when no match is found.
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated MISP user can supply a module name that is not in the instance's enabled modules list. The issue does not describe an unauthenticated exploitation path.
What access or conditions are required for exploitation?
The attacker needs authenticated access to invoke the EventsController queryEnrichment functionality and must provide a module name outside the enabled module set. The vulnerable behavior occurs because unmatched module names are not rejected and processing continues with simplified default parameters.
Are default module availability controls effective against this behavior?
No. A module that is unavailable, legacy, or not explicitly enabled can still be used to trigger enrichment or analysis processing because the requested name is not validated against the enabled-module list.
How can an administrator determine whether an instance is affected?
Review the installed MISP code for the queryEnrichment implementation in EventsController.php and determine whether it rejects module names that are absent from the enabled modules list. The referenced fix is commit 7dfcc4d32.