Vulnerability · Published Jul 8, 2026 · Assigned by CIRCL
CVE-2026-60125importModule function in MISP ignores per-organisation import module restrictions
Medium 5.3
In plain English
A medium-severity incorrect authorization in misp from misp. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities).
Official description
MISP’s importModule() path used getEnabledModule() to resolve a single import module by name, but this lookup did not enforce the per-organisation module restriction checked by getEnabledModules(). As a result, an authenticated user from an organisation that was not allowed to use a module restricted via Plugin.Import_<module>_restrict could still invoke that import module directly if they knew its name. This could allow unauthorised access to restricted import-module functionality and, depending on the module and the user’s event permissions, may allow unauthorised import or modification of event data through a module that should have been unavailable to the user’s organisation.
Affected products (as reported)
Weakness: CWE-863 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:L