CVE-2026-95674 (GCVE-0-2026-95674)

Vulnerability from cvelistv5 – Published: 2026-09-22 13:44 – Updated: 2026-09-22 15:31
VLAI
Title
MISP EventsController queryEnrichment allows querying unavailable or legacy modules without validation
Summary
In MISP, the queryEnrichment method in EventsController.php accepted a module name parameter and iterated over the list of enabled modules to find a match. If the specified module was not present in the enabled modules list, the code silently continued processing using default parameters (format set to 'simplified' and no module-specific configuration applied) rather than rejecting the request. This allowed an authenticated user to trigger enrichment or analysis processing through a module that was not explicitly enabled or available on the instance, bypassing the intended module availability controls. The lack of validation meant that module names outside the enabled set were not rejected, potentially exposing functionality or data processing paths that the administrator had not authorized for use.
Severity
5.3 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-22 15:31 UTC
CWE
  • CWE-20 - Improper Input Validation
Assigner
References
Impacted products
Vendor Product Version CPE status
MISP MISP Affected: 0 , < 2.5.47 (semver)
guessed Create a notification for this product.
Credits
Jeroen Pinoy iglocska
GCVE extensions
AI involvement GCVE-BCP-05-X-01
Whole record AI-generated Human-reviewed GNA-1

Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.

ai-computer-assisted:llm-generatedai-computer-assisted:classification
Model Source Identifier
qwen3.8:27b ollama qwen3.8:27b
Patch provenance GCVE-BCP-05-X-02
Generator
patch2vuln.py on 2026-09-22 13:21
Model
qwen3.8:27b
Input
https://github.com/MISP/MISP/commit/7dfcc4d32.patch 799bc5310fbd…
Confidence
medium
Commit Subject Patch SHA-256
7dfcc4d32970 fix: [security] Harden misp modules module choice 799bc5310fbd…
Fix summary

The fix adds a moduleFound flag that is set only when the requested module name matches an entry in the enabled modules list. After the lookup loop completes, if the flag remains false, the method throws a MethodNotAllowedException with the message 'Module not found or not available,' effectively rejecting any query that references a module not present in the enabled set.

Patch summary

In app/Controller/EventsController.php, the queryEnrichment method is modified: a boolean variable $moduleFound is initialized to false before the foreach loop over $enabledModules['modules']. Inside the loop, when a module name matches, $moduleFound is set to true. After the loop, a new conditional block checks if $moduleFound is still false and throws a MethodNotAllowedException, preventing further processing with an unavailable module.

CVSS rationale

The vulnerability is exploitable over the network (AV:N) via the MISP web interface with low complexity (AC:L) and no attack target manipulation (AT:N). It requires a low-privilege authenticated user (PR:L) and no user interaction (UI:N). The primary impact is a low confidentiality impact (VC:L) because an authenticated user could trigger processing through a module not in the enabled set, potentially exposing data or processing results not intended to be available. No integrity or availability impact is evidenced (VI:N, VA:N). No secondary impacts are indicated (SC:N, SI:N, SA:N). The low impact reflects that the user already has authenticated access to the event and the exposure is limited to an additional module processing path.

Weakness rationale
  • CWE-20 The module name parameter supplied to queryEnrichment was not validated against the set of enabled/available modules. The code accepted any module name and, when no match was found, proceeded with default parameters instead of rejecting the input. The fix adds an explicit validation check that rejects the request when the module is not in the enabled list.
Attack pattern rationale
  • CAPEC-124 The closest plausible attack pattern is parameter tampering: an authenticated user supplies a module name in the queryEnrichment request that is not in the enabled modules list (e.g., a legacy or disabled module). The server previously accepted this parameter value and processed the request with defaults. The uncertainty is that the patch does not explicitly describe an active tampering scenario; it is a server-side validation gap. CAPEC-124 is selected as the best available match because the core mechanism is the manipulation of a request parameter to reference an unauthorized resource.
Assumptions to verify
  • The affected version range is inferred from the tag_version_boundary (v2.5.47 with 138 commits after fix); the exact last affected version and first fixed version are not explicitly stated in the patch metadata.
  • The security impact is assessed as low confidentiality impact based on the limited evidence; the actual data exposure depends on what legacy modules would process, which is not detailed in the patch.
  • CAPEC-124 (Parameter Tampering) is the closest available attack pattern; the actual scenario is a server-side input validation gap rather than an active tampering attack, so the mapping is approximate.
  • The patch does not specify whether the legacy module query could lead to code execution, data exfiltration, or other higher-impact consequences; the CVSS impact metrics are conservatively set to reflect only the evidenced behavior.
  • Authentication is assumed to be required (PR:L) based on MISP being an authenticated web application; the patch does not explicitly state authentication requirements.
Model comparison

Selected qwen3.8:27b by deterministic-consensus-v1
The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required.

Model Score Agreement Confidence Assumptions
qwen3.8:27b 5 9 medium 5
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-95674",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-22T15:31:46.531365Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-22T15:31:52.088Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "modules": [
            "app/Controller/EventsController.php"
          ],
          "product": "MISP",
          "programFiles": [
            "app/Controller/EventsController.php"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.47",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Jeroen Pinoy"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIn MISP, the queryEnrichment method in EventsController.php accepted a module name parameter and iterated over the list of enabled modules to find a match. If the specified module was not present in the enabled modules list, the code silently continued processing using default parameters (format set to \u0027simplified\u0027 and no module-specific configuration applied) rather than rejecting the request. This allowed an authenticated user to trigger enrichment or analysis processing through a module that was not explicitly enabled or available on the instance, bypassing the intended module availability controls. The lack of validation meant that module names outside the enabled set were not rejected, potentially exposing functionality or data processing paths that the administrator had not authorized for use.\u003c/p\u003e"
            }
          ],
          "value": "In MISP, the queryEnrichment method in EventsController.php accepted a module name parameter and iterated over the list of enabled modules to find a match. If the specified module was not present in the enabled modules list, the code silently continued processing using default parameters (format set to \u0027simplified\u0027 and no module-specific configuration applied) rather than rejecting the request. This allowed an authenticated user to trigger enrichment or analysis processing through a module that was not explicitly enabled or available on the instance, bypassing the intended module availability controls. The lack of validation meant that module names outside the enabled set were not rejected, potentially exposing functionality or data processing paths that the administrator had not authorized for use."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-124",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-124 Parameter Tampering"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20 Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-22T13:44:33.427Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/7dfcc4d32"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe fix adds a moduleFound flag that is set only when the requested module name matches an entry in the enabled modules list. After the lookup loop completes, if the flag remains false, the method throws a MethodNotAllowedException with the message \u0027Module not found or not available,\u0027 effectively rejecting any query that references a module not present in the enabled set.\u003c/p\u003e"
            }
          ],
          "value": "The fix adds a moduleFound flag that is set only when the requested module name matches an entry in the enabled modules list. After the lookup loop completes, if the flag remains false, the method throws a MethodNotAllowedException with the message \u0027Module not found or not available,\u0027 effectively rejecting any query that references a module not present in the enabled set."
        }
      ],
      "title": "MISP EventsController queryEnrichment allows querying unavailable or legacy modules without validation",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "full",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The affected version range is inferred from the tag_version_boundary (v2.5.47 with 138 commits after fix); the exact last affected version and first fixed version are not explicitly stated in the patch metadata.",
                  "The security impact is assessed as low confidentiality impact based on the limited evidence; the actual data exposure depends on what legacy modules would process, which is not detailed in the patch.",
                  "CAPEC-124 (Parameter Tampering) is the closest available attack pattern; the actual scenario is a server-side input validation gap rather than an active tampering attack, so the mapping is approximate.",
                  "The patch does not specify whether the legacy module query could lead to code execution, data exfiltration, or other higher-impact consequences; the CVSS impact metrics are conservatively set to reflect only the evidenced behavior.",
                  "Authentication is assumed to be required (PR:L) based on MISP being an authenticated web application; the patch does not explicitly state authentication requirements."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-124",
                    "rationale": "The closest plausible attack pattern is parameter tampering: an authenticated user supplies a module name in the queryEnrichment request that is not in the enabled modules list (e.g., a legacy or disabled module). The server previously accepted this parameter value and processed the request with defaults. The uncertainty is that the patch does not explicitly describe an active tampering scenario; it is a server-side validation gap. CAPEC-124 is selected as the best available match because the core mechanism is the manipulation of a request parameter to reference an unauthorized resource."
                  }
                ],
                "commit": "7dfcc4d32970d553e8c39827dac04889e44f94e0",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "reporter",
                    "value": "Jeroen Pinoy"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  }
                ],
                "cvssRationale": "The vulnerability is exploitable over the network (AV:N) via the MISP web interface with low complexity (AC:L) and no attack target manipulation (AT:N). It requires a low-privilege authenticated user (PR:L) and no user interaction (UI:N). The primary impact is a low confidentiality impact (VC:L) because an authenticated user could trigger processing through a module not in the enabled set, potentially exposing data or processing results not intended to be available. No integrity or availability impact is evidenced (VI:N, VA:N). No secondary impacts are indicated (SC:N, SI:N, SA:N). The low impact reflects that the user already has authenticated access to the event and the exposure is limited to an additional module processing path.",
                "fixSummary": "The fix adds a moduleFound flag that is set only when the requested module name matches an entry in the enabled modules list. After the lookup loop completes, if the flag remains false, the method throws a MethodNotAllowedException with the message \u0027Module not found or not available,\u0027 effectively rejecting any query that references a module not present in the enabled set.",
                "generatedAt": "2026-09-22T13:21:49.468745Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 9,
                      "assumptionCount": 5,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 5
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "799bc5310fbd5bb6079992d5f7713a2d41ce3fbe45aa200523937e921f713cf4",
                "patchSummary": "In app/Controller/EventsController.php, the queryEnrichment method is modified: a boolean variable $moduleFound is initialized to false before the foreach loop over $enabledModules[\u0027modules\u0027]. Inside the loop, when a module name matches, $moduleFound is set to true. After the loop, a new conditional block checks if $moduleFound is still false and throws a MethodNotAllowedException, preventing further processing with an unavailable module.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "7dfcc4d32970d553e8c39827dac04889e44f94e0",
                    "patchSha256": "799bc5310fbd5bb6079992d5f7713a2d41ce3fbe45aa200523937e921f713cf4",
                    "source": "https://github.com/MISP/MISP/commit/7dfcc4d32.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/7dfcc4d32.patch",
                    "subject": "fix: [security] Harden misp modules module choice"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/7dfcc4d32.patch",
                "subject": "fix: [security] Harden misp modules module choice",
                "tagVersionBoundary": {
                  "commits_after_fix": 138,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.47",
                  "version": "2.5.47",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-20",
                    "rationale": "The module name parameter supplied to queryEnrichment was not validated against the set of enabled/available modules. The code accepted any module name and, when no match was found, proceeded with default parameters instead of rejecting the input. The fix adds an explicit validation check that rejects the request when the module is not in the enabled list."
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20127"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-95674",
    "datePublished": "2026-09-22T13:44:33.427Z",
    "dateReserved": "2026-09-22T13:44:31.610Z",
    "dateUpdated": "2026-09-22T15:31:52.088Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-95674",
      "date": "2026-09-27",
      "epss": "0.00406",
      "percentile": "0.32248"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "modules": [
                  "app/Controller/EventsController.php"
                ],
                "product": "MISP",
                "programFiles": [
                  "app/Controller/EventsController.php"
                ],
                "repo": "https://github.com/MISP/MISP",
                "vendor": "MISP",
                "versions": [
                  {
                    "lessThan": "2.5.47",
                    "status": "affected",
                    "version": "0",
                    "versionType": "semver"
                  }
                ]
              }
            ],
            "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In MISP, the queryEnrichment method in EventsController.php accepted a module name parameter and iterated over the list of enabled modules to find a match. If the specified module was not present in the enabled modules list, the code silently continued processing using default parameters (format set to \u0027simplified\u0027 and no module-specific configuration applied) rather than rejecting the request. This allowed an authenticated user to trigger enrichment or analysis processing through a module that was not explicitly enabled or available on the instance, bypassing the intended module availability controls. The lack of validation meant that module names outside the enabled set were not rejected, potentially exposing functionality or data processing paths that the administrator had not authorized for use."
          }
        ],
        "id": "CVE-2026-95674",
        "lastModified": "2026-09-22T16:18:22.263",
        "metrics": {
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 5.3,
                "baseSeverity": "MEDIUM",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "NOT_DEFINED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "LOW",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "LOW",
                "vulnIntegrityImpact": "NONE",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-95674",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-22T15:31:46.531365Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-09-22T14:17:21.990",
        "references": [
          {
            "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
            "url": "https://github.com/MISP/MISP/commit/7dfcc4d32"
          }
        ],
        "sourceIdentifier": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-20"
              }
            ],
            "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-95674",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-09-22T15:31:46.531365Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-09-22T15:31:49.706Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "modules": [
                "app/Controller/EventsController.php"
              ],
              "product": "MISP",
              "programFiles": [
                "app/Controller/EventsController.php"
              ],
              "repo": "https://github.com/MISP/MISP",
              "vendor": "MISP",
              "versions": [
                {
                  "lessThan": "2.5.47",
                  "status": "affected",
                  "version": "0",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "reporter",
              "value": "Jeroen Pinoy"
            },
            {
              "lang": "en",
              "type": "remediation developer",
              "value": "iglocska"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eIn MISP, the queryEnrichment method in EventsController.php accepted a module name parameter and iterated over the list of enabled modules to find a match. If the specified module was not present in the enabled modules list, the code silently continued processing using default parameters (format set to \u0027simplified\u0027 and no module-specific configuration applied) rather than rejecting the request. This allowed an authenticated user to trigger enrichment or analysis processing through a module that was not explicitly enabled or available on the instance, bypassing the intended module availability controls. The lack of validation meant that module names outside the enabled set were not rejected, potentially exposing functionality or data processing paths that the administrator had not authorized for use.\u003c/p\u003e"
                }
              ],
              "value": "In MISP, the queryEnrichment method in EventsController.php accepted a module name parameter and iterated over the list of enabled modules to find a match. If the specified module was not present in the enabled modules list, the code silently continued processing using default parameters (format set to \u0027simplified\u0027 and no module-specific configuration applied) rather than rejecting the request. This allowed an authenticated user to trigger enrichment or analysis processing through a module that was not explicitly enabled or available on the instance, bypassing the intended module availability controls. The lack of validation meant that module names outside the enabled set were not rejected, potentially exposing functionality or data processing paths that the administrator had not authorized for use."
            }
          ],
          "impacts": [
            {
              "capecId": "CAPEC-124",
              "descriptions": [
                {
                  "lang": "en",
                  "value": "CAPEC-124 Parameter Tampering"
                }
              ]
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "baseScore": 5.3,
                "baseSeverity": "MEDIUM",
                "privilegesRequired": "LOW",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "LOW",
                "vulnIntegrityImpact": "NONE",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-20",
                  "description": "CWE-20 Improper Input Validation",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-22T13:44:33.427Z",
            "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
            "shortName": "CIRCL"
          },
          "references": [
            {
              "name": "Security patch",
              "tags": [
                "patch"
              ],
              "url": "https://github.com/MISP/MISP/commit/7dfcc4d32"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eThe fix adds a moduleFound flag that is set only when the requested module name matches an entry in the enabled modules list. After the lookup loop completes, if the flag remains false, the method throws a MethodNotAllowedException with the message \u0027Module not found or not available,\u0027 effectively rejecting any query that references a module not present in the enabled set.\u003c/p\u003e"
                }
              ],
              "value": "The fix adds a moduleFound flag that is set only when the requested module name matches an entry in the enabled modules list. After the lookup loop completes, if the flag remains false, the method throws a MethodNotAllowedException with the message \u0027Module not found or not available,\u0027 effectively rejecting any query that references a module not present in the enabled set."
            }
          ],
          "title": "MISP EventsController queryEnrichment allows querying unavailable or legacy modules without validation",
          "x_gcve": [
            {
              "extensions": {
                "bcp-05-x-01": {
                  "ai_annotations": [
                    {
                      "ai_level": "generated",
                      "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                      "gna_source": 1,
                      "models": [
                        {
                          "gna_source": 1,
                          "identifier": "qwen3.8:27b",
                          "name": "qwen3.8:27b",
                          "source": "ollama"
                        }
                      ],
                      "review_status": "full",
                      "scope": "record",
                      "tags": [
                        "ai-computer-assisted:llm-generated",
                        "ai-computer-assisted:classification"
                      ]
                    }
                  ]
                },
                "bcp-05-x-02": {
                  "x_patch2vuln": {
                    "assumptions": [
                      "The affected version range is inferred from the tag_version_boundary (v2.5.47 with 138 commits after fix); the exact last affected version and first fixed version are not explicitly stated in the patch metadata.",
                      "The security impact is assessed as low confidentiality impact based on the limited evidence; the actual data exposure depends on what legacy modules would process, which is not detailed in the patch.",
                      "CAPEC-124 (Parameter Tampering) is the closest available attack pattern; the actual scenario is a server-side input validation gap rather than an active tampering attack, so the mapping is approximate.",
                      "The patch does not specify whether the legacy module query could lead to code execution, data exfiltration, or other higher-impact consequences; the CVSS impact metrics are conservatively set to reflect only the evidenced behavior.",
                      "Authentication is assumed to be required (PR:L) based on MISP being an authenticated web application; the patch does not explicitly state authentication requirements."
                    ],
                    "capecRationale": [
                      {
                        "capecId": "CAPEC-124",
                        "rationale": "The closest plausible attack pattern is parameter tampering: an authenticated user supplies a module name in the queryEnrichment request that is not in the enabled modules list (e.g., a legacy or disabled module). The server previously accepted this parameter value and processed the request with defaults. The uncertainty is that the patch does not explicitly describe an active tampering scenario; it is a server-side validation gap. CAPEC-124 is selected as the best available match because the core mechanism is the manipulation of a request parameter to reference an unauthorized resource."
                      }
                    ],
                    "commit": "7dfcc4d32970d553e8c39827dac04889e44f94e0",
                    "confidence": "medium",
                    "credits": [
                      {
                        "lang": "en",
                        "type": "reporter",
                        "value": "Jeroen Pinoy"
                      },
                      {
                        "lang": "en",
                        "type": "remediation developer",
                        "value": "iglocska"
                      }
                    ],
                    "cvssRationale": "The vulnerability is exploitable over the network (AV:N) via the MISP web interface with low complexity (AC:L) and no attack target manipulation (AT:N). It requires a low-privilege authenticated user (PR:L) and no user interaction (UI:N). The primary impact is a low confidentiality impact (VC:L) because an authenticated user could trigger processing through a module not in the enabled set, potentially exposing data or processing results not intended to be available. No integrity or availability impact is evidenced (VI:N, VA:N). No secondary impacts are indicated (SC:N, SI:N, SA:N). The low impact reflects that the user already has authenticated access to the event and the exposure is limited to an additional module processing path.",
                    "fixSummary": "The fix adds a moduleFound flag that is set only when the requested module name matches an entry in the enabled modules list. After the lookup loop completes, if the flag remains false, the method throws a MethodNotAllowedException with the message \u0027Module not found or not available,\u0027 effectively rejecting any query that references a module not present in the enabled set.",
                    "generatedAt": "2026-09-22T13:21:49.468745Z",
                    "generator": "patch2vuln.py",
                    "model": "qwen3.8:27b",
                    "modelComparison": {
                      "rankings": [
                        {
                          "agreementScore": 9,
                          "assumptionCount": 5,
                          "confidence": "medium",
                          "model": "qwen3.8:27b",
                          "score": 5
                        }
                      ],
                      "selectedModel": "qwen3.8:27b",
                      "selectionMethod": "deterministic-consensus-v1",
                      "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                    },
                    "patchSha256": "799bc5310fbd5bb6079992d5f7713a2d41ce3fbe45aa200523937e921f713cf4",
                    "patchSummary": "In app/Controller/EventsController.php, the queryEnrichment method is modified: a boolean variable $moduleFound is initialized to false before the foreach loop over $enabledModules[\u0027modules\u0027]. Inside the loop, when a module name matches, $moduleFound is set to true. After the loop, a new conditional block checks if $moduleFound is still false and throws a MethodNotAllowedException, preventing further processing with an unavailable module.",
                    "patchTruncated": false,
                    "patches": [
                      {
                        "commit": "7dfcc4d32970d553e8c39827dac04889e44f94e0",
                        "patchSha256": "799bc5310fbd5bb6079992d5f7713a2d41ce3fbe45aa200523937e921f713cf4",
                        "source": "https://github.com/MISP/MISP/commit/7dfcc4d32.patch",
                        "sourceUrl": "https://github.com/MISP/MISP/commit/7dfcc4d32.patch",
                        "subject": "fix: [security] Harden misp modules module choice"
                      }
                    ],
                    "source": "https://github.com/MISP/MISP/commit/7dfcc4d32.patch",
                    "subject": "fix: [security] Harden misp modules module choice",
                    "tagVersionBoundary": {
                      "commits_after_fix": 138,
                      "repository": "https://github.com/MISP/MISP",
                      "tag": "v2.5.47",
                      "version": "2.5.47",
                      "version_type": "semver"
                    },
                    "weaknessRationale": [
                      {
                        "cweId": "CWE-20",
                        "rationale": "The module name parameter supplied to queryEnrichment was not validated against the set of enabled/available modules. The code accepted any module name and, when no match was found, proceeded with default parameters instead of rejecting the input. The fix adds an explicit validation check that rejects the request when the module is not in the enabled list."
                      }
                    ]
                  }
                }
              },
              "recordType": "advisory",
              "vulnId": "GCVE-1-2026-20127"
            }
          ]
        }
      },
      "cveMetadata": {
        "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "assignerShortName": "CIRCL",
        "cveId": "CVE-2026-95674",
        "datePublished": "2026-09-22T13:44:33.427Z",
        "dateReserved": "2026-09-22T13:44:31.610Z",
        "dateUpdated": "2026-09-22T15:31:52.088Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.