Persistent Storage Vulnerability in MISP by MISP Project

CVE-2026-86452

What is CVE-2026-86452?

The MISP platform, in versions prior to 2.5.45, exhibits a security concern allowing unauthenticated requests to interact with the password reset functionality. The vulnerable endpoint for users/forgot password-reset fails to impose adequate input validation for email addresses, permitting attackers to submit excessively long or improperly formatted email values. Consequently, this leads to the unauthorized creation of audit log entries and repeated queuing for password-reset jobs, with the potential for significant storage abuse via multiple submissions within a single request. The recent patch addresses this vulnerability by enforcing a maximum email length, validating email format before processing, establishing pre-authentication request limits, and introducing HTTP 429 responses when limits are exceeded, alongside a 15-minute cooldown period for subsequent requests.

References