Executive brief
MISP, a threat intelligence platform, did not properly validate whether enrichment modules were enabled before processing requests. An authenticated user could request enrichment from disabled or non-existent modules, which would silently proceed with default settings rather than being rejected. This bypassed administrator controls over which analysis tools were available and could expose unintended functionality or data processing paths.
Technical details
The queryEnrichment method in EventsController.php accepted a module name parameter but failed to validate it against the list of enabled modules. If a module was not in the enabled list, the code continued processing with default parameters (format='simplified', no module-specific config) instead of rejecting the request. This allowed authenticated users to invoke disabled modules, circumventing intended access controls through insufficient input validation.
Affected products
- MISP Project MISP
Timeline
- 2026-09-22: disclosed
- 2026-09-22: patched: Security hardening commit 7dfcc4d