CVE-2026-86452

MISP Unauthenticated Mail Endpoints Allow Unbounded Storage Consumption and Request Flooding

Published Sep 7, 2026 CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Description

Affected versions of MISP permit unauthenticated or weakly constrained request paths to perform persistent work without adequate input bounds or rate limiting.

The users/forgot password-reset endpoint accepted an attacker-controlled email value without first imposing a reasonable length bound or validating its format. That value was then used to create an audit log entry and queue a password-reset job, causing the supplied value to be persisted more than once per request. The commit explicitly states that an unbounded unauthenticated request field was stored twice per call with no throttle.

The fix adds:

- a maximum email input length of 1024 bytes;
- email-format validation before persistent work;
- a per-source pre-authentication request budget;
- HTTP 429 responses when that budget is exceeded;
- a 15-minute cooldown for API-access request emails;
- POST-only handling and CSRF protection for the API-access request endpoint.

The new flood filter is specifically intended to limit persistent storage costs from anonymous requests such as password resets, registrations, and failed REST authentication attempts.

Version affected: ≤2.5.45

Analysis

Technical impact

The vulnerability in MISP allows unauthenticated or weakly constrained requests to perform persistent work without input bounds or rate limiting. Attackers can target the forgot‑password or password‑reset endpoints with arbitrary e‑mail addresses; the system accepts these values without imposing a reasonable length constraint or validating their format, then logs the address and queues a password‑reset job. The submitted value is stored twice per request, resulting in unbounded storage consumption and the potential to flood the service, which can lead to denial of service.

Affected Systems

All MISP installations running version 2.5.45 or earlier are affected, regardless of deployment size.

Risk and Exploitability

The CVSS score of 8.7 indicates a high severity vulnerability. The EPSS score is 0.00306 (indicating a low exploitation probability), and the issue is not listed in CISA KEV. Attackers can exploit the flaw from any remote location without authentication by submitting crafted e‑mail addresses to the vulnerable endpoints. Since the system does not enforce input bounds or throttle, a single malicious actor can flood the service, exhausting disk space or memory. The lack of rate limiting means the attack can be performed continuously until mitigated.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

MISP

unaffected

Version	Status	Constraints
`0`	affected	≤ 2.5.45

Configuration 1 [-]

cpe:2.3:a:misp-project:misp:*:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Misp

Version	Status	Scheme	Platform
`[0,2.5.45]`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Deploy the patch that limits email input length to 1024 bytes, validates format, and implements request budgeting.
Enable the per‑source pre‑authentication request budget, set the HTTP 429 responses, and activate the 15‑minute cooldown for API‑access email requests.
Continuously monitor audit logs for repeated email‑related requests and apply IP blocking or further throttling for sources that exceed limits.

Generated by OpenCVE AI on September 21, 2026 at 05:48 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.542% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://github.com/MISP/MISP/commit/d75d899be

History

Sep 14, 2026 7:00 AM Description updated View changes

Type	Values Removed	Values Added
Description	Affected versions of MISP permit unauthenticated or weakly constrained request paths to perform persistent work without adequate input bounds or rate limiting. The users/forgot password-reset endpoint accepted an attacker-controlled email value without first imposing a reasonable length bound or validating its format. That value was then used to create an audit log entry and queue a password-reset job, causing the supplied value to be persisted more than once per request. The commit explicitly states that an unbounded unauthenticated request field was stored twice per call with no throttle. The fix adds: * a maximum email input length of 1024 bytes; * email-format validation before persistent work; * a per-source pre-authentication request budget; * HTTP 429 responses when that budget is exceeded; * a 15-minute cooldown for API-access request emails; * POST-only handling and CSRF protection for the API-access request endpoint. The new flood filter is specifically intended to limit persistent storage costs from anonymous requests such as password resets, registrations, and failed REST authentication attempts. Version affected: ≤2.5.45	Affected versions of MISP permit unauthenticated or weakly constrained request paths to perform persistent work without adequate input bounds or rate limiting. The users/forgot password-reset endpoint accepted an attacker-controlled email value without first imposing a reasonable length bound or validating its format. That value was then used to create an audit log entry and queue a password-reset job, causing the supplied value to be persisted more than once per request. The commit explicitly states that an unbounded unauthenticated request field was stored twice per call with no throttle. The fix adds: - a maximum email input length of 1024 bytes; - email-format validation before persistent work; - a per-source pre-authentication request budget; - HTTP 429 responses when that budget is exceeded; - a 15-minute cooldown for API-access request emails; - POST-only handling and CSRF protection for the API-access request endpoint. The new flood filter is specifically intended to limit persistent storage costs from anonymous requests such as password resets, registrations, and failed REST authentication attempts. Version affected: ≤2.5.45

Sep 9, 2026 3:30 PM First appearance in the feed. Affected versions updated. Affected vendors updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
First Time appeared		Misp-project Misp-project misp
CPEs		cpe:2.3:a:misp-project:misp::::::::
Vendors & Products		Misp-project Misp-project misp
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}`

Sep 8, 2026 3:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sep 7, 2026 3:45 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Misp Misp misp
Vendors & Products		Misp Misp misp

Sep 7, 2026 1:30 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Affected versions of MISP permit unauthenticated or weakly constrained request paths to perform persistent work without adequate input bounds or rate limiting. The users/forgot password-reset endpoint accepted an attacker-controlled email value without first imposing a reasonable length bound or validating its format. That value was then used to create an audit log entry and queue a password-reset job, causing the supplied value to be persisted more than once per request. The commit explicitly states that an unbounded unauthenticated request field was stored twice per call with no throttle. The fix adds: * a maximum email input length of 1024 bytes; * email-format validation before persistent work; * a per-source pre-authentication request budget; * HTTP 429 responses when that budget is exceeded; * a 15-minute cooldown for API-access request emails; * POST-only handling and CSRF protection for the API-access request endpoint. The new flood filter is specifically intended to limit persistent storage costs from anonymous requests such as password resets, registrations, and failed REST authentication attempts. Version affected: ≤2.5.45
Title		MISP Unauthenticated Mail Endpoints Allow Unbounded Storage Consumption and Request Flooding
Weaknesses		CWE-400 CWE-770
References		https://github.com/MISP/MISP/commit/d75d899be
Metrics		cvssV4_0 `{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}`