CVE-2026-60125

Name of the Vulnerable Software and Affected Versions MISP (affected versions not specified)

Description The importModule() path uses the getEnabledModule() function to resolve a single import module by name. However, this lookup fails to enforce the per-organisation module restrictions that are normally checked by getEnabledModules(). Consequently, an authenticated user belonging to an organisation restricted from using a specific module via Plugin.Import <module> restrict can still invoke that module directly if the module name is known. This may lead to unauthorised access to restricted import-module functionality and potentially allow the unauthorised import or modification of event data, depending on the specific module and the user's event permissions.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.