CVE-2026-86452
Received Received - Intake

Persistent Password Reset Flood in MISP

Publication date: 2026-09-07

Last updated on: 2026-09-07

Assigner: CIRCL

Description
Affected versions of MISP permit unauthenticated or weakly constrained request paths to perform persistent work without adequate input bounds or rate limiting. The users/forgot password-reset endpoint accepted an attacker-controlled email value without first imposing a reasonable length bound or validating its format. That value was then used to create an audit log entry and queue a password-reset job, causing the supplied value to be persisted more than once per request. The commit explicitly states that an unbounded unauthenticated request field was stored twice per call with no throttle. The fix adds: * a maximum email input length of 1024 bytes; * email-format validation before persistent work; * a per-source pre-authentication request budget; * HTTP 429 responses when that budget is exceeded; * a 15-minute cooldown for API-access request emails; * POST-only handling and CSRF protection for the API-access request endpoint. The new flood filter is specifically intended to limit persistent storage costs from anonymous requests such as password resets, registrations, and failed REST authentication attempts. Version affected: ≤2.5.45

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-07
Last Modified
2026-09-07
Generated
2026-09-07
AI Q&A
2026-09-07
EPSS Evaluated
N/A
NVD
CVE-2026-86452
EUVD
EUVD-2026-72398

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
misp misp to 2.5.45 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in MISP allows unauthenticated users to send requests to endpoints like password reset or API access without proper limits. The system previously accepted unbounded email values, storing them multiple times per request without validation or rate limiting. This could lead to persistent storage abuse, log flooding, or job queue overload.

Detection Guidance

Monitor for unusual activity on MISP endpoints like password reset or API access requests. Check logs for excessive unauthenticated requests or malformed email inputs. Use rate-limiting metrics to detect bursts exceeding thresholds.

Impact Analysis

An attacker could exploit this to cause denial-of-service by flooding the system with requests, consuming resources, or enumerating accounts via password reset responses. Unbounded storage of malicious input may also corrupt logs or job queues.

Compliance Impact

The vulnerability could lead to unauthorized resource consumption and potential data exposure through unauthenticated flood attacks on endpoints like password resets. This may violate GDPR principles of data minimization and security, as well as HIPAA requirements for protecting electronic protected health information (ePHI) by allowing excessive unauthenticated access to systems that handle sensitive data.

Mitigation Strategies

Upgrade MISP to version 2.5.46 or later. Enable the pre-authentication flood filter and set thresholds. Validate email formats strictly. Implement POST-only handling and CSRF protection for sensitive endpoints.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86452. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart