Berk Polat

**Name of the Vulnerable Software and Affected Versions** MISP (affected versions not specified) **Description** An authorization bypass exists in the `importModule()` function within the `EventsController`. This flaw allows authenticated users or read-only API keys with event view access to persist data to events they are not permitted to modify. The issue occurs when an import module returns results in the misp standard format, as the write path fails to verify event modification rights before saving the output. This allows a view-only user to inject or alter event data, compromising the integrity of the event content. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** MISP (affected versions not specified) **Description** The `importModule()` path uses the `getEnabledModule()` function to resolve a single import module by name. However, this lookup fails to enforce the per-organisation module restrictions that are normally checked by `getEnabledModules()`. Consequently, an authenticated user belonging to an organisation restricted from using a specific module via `Plugin.Import <module> restrict` can still invoke that module directly if the module name is known. This may lead to unauthorised access to restricted import-module functionality and potentially allow the unauthorised import or modification of event data, depending on the specific module and the user's event permissions. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.