CVE-2026-95674 - MISP EventsController queryEnrichment allows querying unavailable or legacy modules without validation
Brief
CVE ID : CVE-2026-95674
Published : Sept. 22, 2026, 2:17 p. m.
- 41 minutes ago
Description : In MISP, the queryEnrichment method in EventsController. php accepted a module name parameter and iterated over the list of enabled modules to find a match. If the specified module was not present in the enabled modules list, the code silently continued processing using default parameters (format set to 'simplified' and no module-specific configuration applied) rather than rejecting the request.
This allowed an authenticated user to trigger enrichment or analysis processing through a module that was not explicitly enabled or available on the instance, bypassing the intended module availability controls.