MISP CVE-2026-95674

Requires an authenticated MISP account (CVSS PR:L) with access to the enrichment/analysis functionality of EventsController. The trigger is specifically the queryEnrichment method accepting an arbitrary module-name parameter: supplying a module name NOT present in the instance's enabled-modules list causes the code to silently continue with default parameters (format='simplified', no module-specific config) rather than rejecting it. Limiting factors: no unauthenticated path (login needed), impact is confined to confidentiality-low with no integrity or availability effect, and abuse is bounded by which processing paths exist on the instance; there is no scope change to other systems.

This is a low-severity, authenticated access-control weakness, not a high-priority emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N) scores 5.3 and consistently signals limited impact: confidentiality-low only, with no integrity or availability impact and no scope change. PR:L confirms an already-authenticated MISP user is required, so this is a post-authentication control bypass, not a pre-auth breach. No EPSS score, no SSVC decision data, no CISA KEV listing, and no public POC were provided - meaning there is no evidence of active exploitation or automatability; the only positive signals are a confirmed vendor patch (commit 7dfcc4d32) and CIRCL as the reporter. The CWE-20 (improper input validation) root cause and the description align cleanly with the CVSS vector - an authenticated user can invoke enrichment via a module outside the enabled set because the code silently falls back to default 'simplified' parameters instead of rejecting the request. No signals conflict. Net: a real but minor defense-in-depth/authorization hardening fix, not a widespread-exploitation risk.

An authenticated MISP user submits an enrichment request via EventsController's queryEnrichment naming a module that the administrator did not enable on the instance; instead of being rejected, the request is silently processed with default 'simplified' parameters, exercising a processing path the admin never authorized. No public exploit code was identified, and the low CVSS (PR:L, VC:L only) reflects the bounded, authenticated nature of the abuse.