MISP’s importModule() function resolves an import module name using getEnabledModule(), but this lookup bypasses the per‑organisation restriction normally enforced by getEnabledModules(). As a result, an authenticated user who belongs to an organisation that is not allowed to use a particular module can still invoke that module directly if they know its name. This access control flaw (CWE‑863) permits potentially unauthorized import or alteration of event data that should remain hidden from the user’s organisation, thereby breaking data confidentiality and integrity in the platform.

All installations of MISP that run any version before the commit referenced in the advisory are vulnerable. Since the CVE does not specify a discrete version range, any MISP instance that has not yet deployed the post‑commit code is at risk until the fix is applied.

The CVSS score of 5.3 indicates a moderate severity. The EPSS score of less than 1 % reflects a very low but non‑zero probability that the vulnerability will be exploited, and the issue is not listed in CISA’s KEV catalog. An attacker must be authenticated to the system and must know the exact name of a restricted import module to succeed. Once the bypass is achieved, the attacker may introduce malicious data or modify existing events, depending on their event‑level permissions.