In MISP, the queryEnrichment method in EventsController.php accepted a module name parameter and iterated over the list of enabled modules to find a match. If the specified module was not present in the enabled modules list, the code silently continued processing using default parameters (format set to 'simplified' and no module-specific configuration applied) rather than rejecting the request. This allowed an authenticated user to trigger enrichment or analysis processing through a module that was not explicitly enabled or available on the instance, bypassing the intended module availability controls. The lack of validation meant that module names outside the enabled set were not rejected, potentially exposing functionality or data processing paths that the administrator had not authorized for use.
"}],"value":"In MISP, the queryEnrichment method in EventsController.php accepted a module name parameter and iterated over the list of enabled modules to find a match. If the specified module was not present in the enabled modules list, the code silently continued processing using default parameters (format set to 'simplified' and no module-specific configuration applied) rather than rejecting the request. This allowed an authenticated user to trigger enrichment or analysis processing through a module that was not explicitly enabled or available on the instance, bypassing the intended module availability controls. The lack of validation meant that module names outside the enabled set were not rejected, potentially exposing functionality or data processing paths that the administrator had not authorized for use."}],"impacts":[{"capecId":"CAPEC-124","descriptions":[{"lang":"en","value":"CAPEC-124 Parameter Tampering"}]}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":5.3,"baseSeverity":"MEDIUM","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-20","description":"CWE-20 Improper Input Validation","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-09-22T13:44:33.427Z","orgId":"5a6e4751-2f3f-4070-9419-94fb35b644e8","shortName":"CIRCL"},"references":[{"name":"Security patch","tags":["patch"],"url":"https://github.com/MISP/MISP/commit/7dfcc4d32"}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"The fix adds a moduleFound flag that is set only when the requested module name matches an entry in the enabled modules list. After the lookup loop completes, if the flag remains false, the method throws a MethodNotAllowedException with the message 'Module not found or not available,' effectively rejecting any query that references a module not present in the enabled set.
"}],"value":"The fix adds a moduleFound flag that is set only when the requested module name matches an entry in the enabled modules list. After the lookup loop completes, if the flag remains false, the method throws a MethodNotAllowedException with the message 'Module not found or not available,' effectively rejecting any query that references a module not present in the enabled set."}],"title":"MISP EventsController queryEnrichment allows querying unavailable or legacy modules without validation","x_gcve":[{"extensions":{"bcp-05-x-01":{"ai_annotations":[{"ai_level":"generated","description":"Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.","gna_source":1,"models":[{"gna_source":1,"identifier":"qwen3.8:27b","name":"qwen3.8:27b","source":"ollama"}],"review_status":"full","scope":"record","tags":["ai-computer-assisted:llm-generated","ai-computer-assisted:classification"]}]},"bcp-05-x-02":{"x_patch2vuln":{"assumptions":["The affected version range is inferred from the tag_version_boundary (v2.5.47 with 138 commits after fix); the exact last affected version and first fixed version are not explicitly stated in the patch metadata.","The security impact is assessed as low confidentiality impact based on the limited evidence; the actual data exposure depends on what legacy modules would process, which is not detailed in the patch.","CAPEC-124 (Parameter Tampering) is the closest available attack pattern; the actual scenario is a server-side input validation gap rather than an active tampering attack, so the mapping is approximate.","The patch does not specify whether the legacy module query could lead to code execution, data exfiltration, or other higher-impact consequences; the CVSS impact metrics are conservatively set to reflect only the evidenced behavior.","Authentication is assumed to be required (PR:L) based on MISP being an authenticated web application; the patch does not explicitly state authentication requirements."],"capecRationale":[{"capecId":"CAPEC-124","rationale":"The closest plausible attack pattern is parameter tampering: an authenticated user supplies a module name in the queryEnrichment request that is not in the enabled modules list (e.g., a legacy or disabled module). The server previously accepted this parameter value and processed the request with defaults. The uncertainty is that the patch does not explicitly describe an active tampering scenario; it is a server-side validation gap. CAPEC-124 is selected as the best available match because the core mechanism is the manipulation of a request parameter to reference an unauthorized resource."}],"commit":"7dfcc4d32970d553e8c39827dac04889e44f94e0","confidence":"medium","credits":[{"lang":"en","type":"reporter","value":"Jeroen Pinoy"},{"lang":"en","type":"remediation developer","value":"iglocska"}],"cvssRationale":"The vulnerability is exploitable over the network (AV:N) via the MISP web interface with low complexity (AC:L) and no attack target manipulation (AT:N). It requires a low-privilege authenticated user (PR:L) and no user interaction (UI:N). The primary impact is a low confidentiality impact (VC:L) because an authenticated user could trigger processing through a module not in the enabled set, potentially exposing data or processing results not intended to be available. No integrity or availability impact is evidenced (VI:N, VA:N). No secondary impacts are indicated (SC:N, SI:N, SA:N). The low impact reflects that the user already has authenticated access to the event and the exposure is limited to an additional module processing path.","fixSummary":"The fix adds a moduleFound flag that is set only when the requested module name matches an entry in the enabled modules list. After the lookup loop completes, if the flag remains false, the method throws a MethodNotAllowedException with the message 'Module not found or not available,' effectively rejecting any query that references a module not present in the enabled set.","generatedAt":"2026-09-22T13:21:49.468745Z","generator":"patch2vuln.py","model":"qwen3.8:27b","modelComparison":{"rankings":[{"agreementScore":9,"assumptionCount":5,"confidence":"medium","model":"qwen3.8:27b","score":5}],"selectedModel":"qwen3.8:27b","selectionMethod":"deterministic-consensus-v1","selectionNotice":"The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."},"patchSha256":"799bc5310fbd5bb6079992d5f7713a2d41ce3fbe45aa200523937e921f713cf4","patchSummary":"In app/Controller/EventsController.php, the queryEnrichment method is modified: a boolean variable $moduleFound is initialized to false before the foreach loop over $enabledModules['modules']. Inside the loop, when a module name matches, $moduleFound is set to true. After the loop, a new conditional block checks if $moduleFound is still false and throws a MethodNotAllowedException, preventing further processing with an unavailable module.","patchTruncated":false,"patches":[{"commit":"7dfcc4d32970d553e8c39827dac04889e44f94e0","patchSha256":"799bc5310fbd5bb6079992d5f7713a2d41ce3fbe45aa200523937e921f713cf4","source":"https://github.com/MISP/MISP/commit/7dfcc4d32.patch","sourceUrl":"https://github.com/MISP/MISP/commit/7dfcc4d32.patch","subject":"fix: [security] Harden misp modules module choice"}],"source":"https://github.com/MISP/MISP/commit/7dfcc4d32.patch","subject":"fix: [security] Harden misp modules module choice","tagVersionBoundary":{"commits_after_fix":138,"repository":"https://github.com/MISP/MISP","tag":"v2.5.47","version":"2.5.47","version_type":"semver"},"weaknessRationale":[{"cweId":"CWE-20","rationale":"The module name parameter supplied to queryEnrichment was not validated against the set of enabled/available modules. The code accepted any module name and, when no match was found, proceeded with default parameters instead of rejecting the input. The fix adds an explicit validation check that rejects the request when the module is not in the enabled list."}]}}},"recordType":"advisory","vulnId":"GCVE-1-2026-20127"}]}},"cveMetadata":{"assignerOrgId":"5a6e4751-2f3f-4070-9419-94fb35b644e8","assignerShortName":"CIRCL","cveId":"CVE-2026-95674","datePublished":"2026-09-22T13:44:33.427Z","dateReserved":"2026-09-22T13:44:31.610Z","dateUpdated":"2026-09-22T15:31:52.088Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-09-22 14:17:21","lastModifiedDate":"2026-09-22 16:18:22","problem_types":["CWE-20","CWE-20 CWE-20 Improper Input Validation"],"metrics":{"cvssMetricV40":[{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-22T15:31:46.531365Z","id":"CVE-2026-95674","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"95674","Ordinal":"1","Title":"MISP EventsController queryEnrichment allows querying unavailabl","CVE":"CVE-2026-95674","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"95674","Ordinal":"1","NoteData":"In MISP, the queryEnrichment method in EventsController.php accepted a module name parameter and iterated over the list of enabled modules to find a match. If the specified module was not present in the enabled modules list, the code silently continued processing using default parameters (format set to 'simplified' and no module-specific configuration applied) rather than rejecting the request. This allowed an authenticated user to trigger enrichment or analysis processing through a module that was not explicitly enabled or available on the instance, bypassing the intended module availability controls. The lack of validation meant that module names outside the enabled set were not rejected, potentially exposing functionality or data processing paths that the administrator had not authorized for use.","Type":"Description","Title":"MISP EventsController queryEnrichment allows querying unavailabl"}]}}}