Description
Affected versions of MISP permit unauthenticated or weakly constrained request paths to perform persistent work without adequate input bounds or rate limiting.


The users/forgot password-reset endpoint accepted an attacker-controlled email value without first imposing a reasonable length bound or validating its format. That value was then used to create an audit log entry and queue a password-reset job, causing the supplied value to be persisted more than once per request. The commit explicitly states that an unbounded unauthenticated request field was stored twice per call with no throttle.


The fix adds:



*
a maximum email input length of 1024 bytes;


*
email-format validation before persistent work;


*
a per-source pre-authentication request budget;


*
HTTP 429 responses when that budget is exceeded;


*
a 15-minute cooldown for API-access request emails;


*
POST-only handling and CSRF protection for the API-access request endpoint.





The new flood filter is specifically intended to limit persistent storage costs from anonymous requests such as password resets, registrations, and failed REST authentication attempts.

Version affected: ≤2.5.45
Published: 2026-09-07
Score: 8.7 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability in MISP allows unauthenticated users to submit arbitrary email values to endpoints such as forgot password, causing the system to persist these values multiple times and queue password‑reset jobs without any input validation or rate limiting. This results in unbounded storage consumption and the potential to flood the system with requests, leading to denial of service. The weakness is typical of resource exhaustion flaws, identified as CWE-400 and CWE-770.

Affected Systems

All MISP installations running version 2.5.45 or earlier are affected, regardless of deployment size.

Risk and Exploitability

The CVSS score of 8.7 indicates a high severity vulnerability. No EPSS data is available, and the issue is not listed in CISA KEV. Attackers can exploit the flaw from any remote location without authentication by submitting crafted email addresses to the vulnerable endpoints. Since the system does not enforce input bounds or throttle, a single malicious actor can flood the service, exhausting disk space or memory. The lack of rate limiting means the attack can be performed continuously until mitigated.

Generated by OpenCVE AI on September 7, 2026 at 15:01 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Deploy the patch that limits email input length to 1024 bytes, validates format, and implements request budgeting.
  • Enable the per‑source pre‑authentication request budget, set the HTTP 429 responses, and activate the 15‑minute cooldown for API‑access email requests.
  • Continuously monitor audit logs for repeated email‑related requests and apply IP blocking or further throttling for sources that exceed limits.

Generated by OpenCVE AI on September 7, 2026 at 15:01 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 07 Sep 2026 15:45:00 +0000

Type Values Removed Values Added
First Time appeared Misp
Misp misp
Vendors & Products Misp
Misp misp

Mon, 07 Sep 2026 13:30:00 +0000

Type Values Removed Values Added
Description Affected versions of MISP permit unauthenticated or weakly constrained request paths to perform persistent work without adequate input bounds or rate limiting. The users/forgot password-reset endpoint accepted an attacker-controlled email value without first imposing a reasonable length bound or validating its format. That value was then used to create an audit log entry and queue a password-reset job, causing the supplied value to be persisted more than once per request. The commit explicitly states that an unbounded unauthenticated request field was stored twice per call with no throttle. The fix adds: * a maximum email input length of 1024 bytes; * email-format validation before persistent work; * a per-source pre-authentication request budget; * HTTP 429 responses when that budget is exceeded; * a 15-minute cooldown for API-access request emails; * POST-only handling and CSRF protection for the API-access request endpoint. The new flood filter is specifically intended to limit persistent storage costs from anonymous requests such as password resets, registrations, and failed REST authentication attempts. Version affected: ≤2.5.45
Title MISP Unauthenticated Mail Endpoints Allow Unbounded Storage Consumption and Request Flooding
Weaknesses CWE-400
CWE-770
References
Metrics cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Misp Misp
cve-icon MITRE

Status: PUBLISHED

Assigner: CIRCL

Published:

Updated: 2026-09-07T13:03:27.052Z

Reserved: 2026-09-07T13:03:25.588Z

Link: CVE-2026-86452

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-07T14:16:56.833

Modified: 2026-09-07T14:16:56.833

Link: CVE-2026-86452

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-07T15:30:06Z

Weaknesses
  • CWE-400

    Uncontrolled Resource Consumption

  • CWE-770

    Allocation of Resources Without Limits or Throttling