---
id: CVE-2026-95658
title: >-
  MISP's WorkflowsController exposed the moduleStatelessExecution action in the
  Security component's unlockedActions list
summary: >-
  MISP's WorkflowsController exposed the moduleStatelessExecution action in the
  Security component's unlockedActions list. In CakePHP, listing an action in
  unlockedActions disables both the CSRF token check and the field hash
  validation fo…
severity: medium
cvss: 6.9
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N'
cwe:
  - CWE-352
vendor: MISP
product: MISP
affected:
  - MISP < 2.5.47
published: '2026-09-22'
updated: '2026-09-22'
sourceUpdated: '2026-09-22T16:18:19.100'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-95658'
references:
  - url: 'https://github.com/MISP/MISP/commit/f05e0d1c2'
    label: 5a6e4751-2f3f-4070-9419-94fb35b644e8
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-22T15:34:56.912472Z'
cvssSource: cna
ingestedAt: '2026-09-22T13:03:40.037Z'
epss: 0.00266
epssPercentile: 0.16441
---

## Overview

MISP's WorkflowsController exposed the moduleStatelessExecution action in the Security component's unlockedActions list. In CakePHP, listing an action in unlockedActions disables both the CSRF token check and the field hash validation for that action. Because moduleStatelessExecution executes a workflow module's exec() method with caller-supplied input and parameters, the absence of CSRF protection allowed an attacker to craft a cross-site form post (or equivalent cross-origin request) that, when submitted by an authenticated site administrator, would cause the administrator's browser to invoke the action on the MISP instance. 

The attacker could select any workflow module to execute, including action modules that write blocklist and warninglist entries, and supply arbitrary input and parameters of their choosing. This constitutes a cross-site request forgery (CSRF) vulnerability with high integrity impact on the MISP instance's security-related data. 

The vulnerability was identified during an internal security review and was not externally reported. The fix is included in MISP v2.5.47.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.