EUVD-2026-42241
GHSA-6vww-2wx8-q6x4
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible bypass requiring only authenticated access (PR:L); impact confined to low-integrity writes on MISP event data with no confidentiality or availability effect.
Primary rating from Vendor (5a6e4751-2f3f-4070-9419-94fb35b644e8).
CVSS VectorVendor: 5a6e4751-2f3f-4070-9419-94fb35b644e8
Lifecycle Timeline
1DescriptionCVE.org
MISP’s importModule() path used getEnabledModule() to resolve a single import module by name, but this lookup did not enforce the per-organisation module restriction checked by getEnabledModules(). As a result, an authenticated user from an organisation that was not allowed to use a module restricted via Plugin.Import_<module>_restrict could still invoke that import module directly if they knew its name.
This could allow unauthorised access to restricted import-module functionality and, depending on the module and the user’s event permissions, may allow unauthorised import or modification of event data through a module that should have been unavailable to the user’s organisation.
AnalysisAI
Incorrect authorization in MISP versions through 2.5.42 allows authenticated users from restricted organizations to invoke import modules that their organization has been explicitly blocked from using via the Plugin.Import_<module>_restrict configuration. The importModule() function relied on getEnabledModule() - a single-module lookup that lacks per-organisation restriction awareness - rather than the restriction-enforcing getEnabledModules(), creating a logical bypass exploitable by any authenticated user who knows a restricted module's name. Depending on the targeted module and the attacker's event permissions, this can result in unauthorized import or modification of MISP event data; no public exploit exists and this vulnerability is not listed in CISA KEV at time of analysis.
Technical ContextAI
MISP (Malware Information Sharing Platform) is an open-source threat intelligence sharing and collaboration platform widely used by CERTs, ISACs, and national cybersecurity agencies. Its import module subsystem allows organizations to ingest data from external sources using named plugin modules. Per-organization restrictions are enforced via Plugin.Import_<module>_restrict settings, which are supposed to gate access to specific modules based on the requesting user's organization. The root cause (CWE-863: Incorrect Authorization) is a logical mismatch in the importModule() code path: it calls getEnabledModule() to resolve a module by name, but this function does not consult the per-organisation restriction list - only getEnabledModules() performs that check. The fix is available upstream as commit 0ed79b4d3177f4b9e44040962161a1a436d2587d on the MISP GitHub repository. No CPE string was provided in available intelligence sources; affected versions are identified as MISP 0 through 2.5.42 per ENISA EUVD-2026-42241.
RemediationAI
Apply the upstream fix available at https://github.com/MISP/MISP/commit/0ed79b4d3177f4b9e44040962161a1a436d2587d, which corrects importModule() to enforce per-organisation restrictions consistently. A specific patched release version is not confirmed in the available data - operators should monitor the MISP release channel for a tagged version referencing this fix before deploying in production environments with change-control requirements. As a compensating control, organizations should audit all Plugin.Import_<module>_restrict configurations to confirm restrictions are necessary and remove any that are unused, reducing the attack surface of this bypass. Restricting MISP network access to known trusted IP ranges or authenticated proxies will limit who can reach the import module endpoints, though this may affect legitimate API integrations. Review MISP access logs for unexpected import module invocations from users in restricted organizations to identify potential prior exploitation.
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today