Access Log Data Corruption in MISP by MISP Project
CVE-2026-91859

5.3MEDIUM

Key Information:

Vendor

Misp

Status
Misp
Vendor
CVE Published:
15 September 2026

What is CVE-2026-91859?

A vulnerability in MISP allows incorrect access-log data recording for requests that result in exceptions. This occurs because the CakeErrorController, which extends AppController, executes the application startup path a second time during exception rendering. Consequently, the __accessMonitor() method invokes AccessLog::logRequest() twice for a single HTTP request. The second invocation overwrites the first log entry, leading to corrupted fields, including request duration and SQL query counts. This issue may result in inaccurate metrics and analytics for the application, potentially masking significant security blind spots.

Affected Version(s)

MISP 0 < 2.5.46

References

https://github.com/MISP/MISP/commit/0dae5c072
patch

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

iglocska
Claude Opus 5 (1M context)
.