The queryEnrichment method in MISP’s EventsController allows an authenticated user to specify a module name that the application will try to use for enrichment or analysis. If the supplied module is not in the enabled modules list, the code silently proceeds with default parameters, effectively permitting the use of modules that the administrator has not explicitly enabled. The absence of validation may expose unintended functionality or data paths, allowing the user to manipulate payloads or extraction flows that are not meant to be available. This flaw can lead to unauthorized access to processing features and potentially sensitive data. The weakness is a classic input validation issue (CWE‑20).

This vulnerability affects the MISP platform, specifically the EventsController in the MISP web application. All versions of MISP that include the queryEnrichment method but lack the recent patch (commit 7dfcc4d32) are vulnerable. Administrators should verify whether their MISP instances are running a version older than the fix and consider applying the update.

The CVSS score of 5.3 indicates a moderate risk profile. The EPSS score is not available, so the current exploit probability cannot be quantified, and the vulnerability is not listed in CISA KEV. The exploit requires authenticated access to the MISP web interface, so it is limited to users who already have login credentials. An attacker with such credentials could trigger enrichment using a non‑enabled module; internal users with higher privileges could misuse the flaw to access data or functions that are intended to be restricted. The impact is confined to the application scope, with no evident remote code execution or privilege escalation beyond the user’s permissions, but the lack of defensive checks can undermine the intended security boundaries of the system.