CVE-2026-95658

Name of the Vulnerable Software and Affected Versions MISP versions prior to 2.5.47

Description The WorkflowsController exposes the moduleStatelessExecution action within the Security component's unlockedActions list. In the CakePHP framework, including an action in unlockedActions disables field hash validation and Cross-Site Request Forgery (CSRF) token checks. Since moduleStatelessExecution triggers a workflow module's exec() function using input and parameters provided by the caller, an attacker can craft a cross-site form post or cross-origin request. If an authenticated site administrator submits this request, it triggers the action on the MISP instance, allowing the attacker to execute any workflow module, including those that modify blocklist and warninglist entries, with arbitrary parameters.

Recommendations Update to version 2.5.47.