CVE-2026-86452— MISP Unauthenticated Mail Endpoints Allow Unbounded Storage Consumption and Request Flooding
Quick assessment
Affected
MISP MISP
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
受影响的 MISP 版本允许未认证或约束较弱的请求路径在缺乏充分的输入边界或速率限制的情况下执行持久化操作。 端点会接受攻击者控制的邮箱值，但在执行持久化操作前，既未施加合理的长度限制，也未对其格式进行校验。随后，该值被用于创建审计日志条目并排队执行密码重置任务，导致每次请求中提供的值会被持久化存储多次。该提交明确说明：一个无界的未认证请求字段在每次调用中会被存储两次，且没有任何节流机制。 修复内容增加了以下措施： 邮箱输入的最大长度限制为 1024 字节； 在执行持久化操作前对邮箱格式进行校验； 针对单个来源的预
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-86452
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
MISP Unauthenticated Mail Endpoints Allow Unbounded Storage Consumption and Request Flooding
Source: CVE Program / CVE List V5
Vulnerability Description
Affected versions of MISP permit unauthenticated or weakly constrained request paths to perform persistent work without adequate input bounds or rate limiting.
The users/forgot password-reset endpoint accepted an attacker-controlled email value without first imposing a reasonable length bound or validating its format. That value was then used to create an audit log entry and queue a password-reset job, causing the supplied value to be persisted more than once per request. The commit explicitly states that an unbounded unauthenticated request field was stored twice per call with no throttle.
The fix adds:
*
a maximum email input length of 1024 bytes;
*
email-format validation before persistent work;
*
a per-source pre-authentication request budget;
*
HTTP 429 responses when that budget is exceeded;
*
a 15-minute cooldown for API-access request emails;
*
POST-only handling and CSRF protection for the API-access request endpoint.
The new flood filter is specifically intended to limit persistent storage costs from anonymous requests such as password resets, registrations, and failed REST authentication attempts.
Version affected: ≤2.5.45
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
未加控制的资源消耗(资源穷尽)
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-86452
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-86452
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-86452 (1)
Same Patch Batch · MISP · 2026-09-07 · 11 CVEs total
| CVE-2026-86347 | 7.1 HIGH | MISP Missing Authorization on Template File Upload Allows Authenticated Disk Exhaustion |
| CVE-2026-86408 | 7.1 HIGH | MISP Missing Authorization in Cryptographic Key View Exposes Signing Keys from Protected E |
| CVE-2026-86419 | 7.0 HIGH | MISP Insufficient Outbound URL Validation Allows SSRF and Credential Disclosure via Feed R |
| CVE-2026-86342 | 5.3 MEDIUM | MISP Freetext Feed Preview Improper Authorization Exposes Restricted Event and Feed Inform |
| CVE-2026-86417 | 5.3 MEDIUM | MISP Dashboard Template REST API Exposes Template Owner Email Addresses to Unauthorized Us |
| CVE-2026-86451 | 5.3 MEDIUM | MISP Event Graph Object Reference Lookup Exposes References from Unauthorized Objects |
| CVE-2026-86351 | 5.1 MEDIUM | MISP User Homepage Validation Allows Authenticated Open Redirect via Protocol-Relative URL |
| CVE-2026-86440 | 5.1 MEDIUM | MISP Dashboard Button Widget Allows Stored XSS via Unsafe javascript: and Backslash URLs |
| CVE-2026-86418 | 2.3 LOW | MISP Dashboard Organisation Picker Exposes Hidden Organisation Metadata to Unauthorized Us |
| CVE-2026-86441 | 2.3 LOW | MISP Dashboard Organisation Widgets Bypass Organisation-Index Restrictions and Expose Hidd |
IV. Related Vulnerabilities
Same product: MISP
-
CVE-2026-86451
MISP Event Graph Object Reference Lookup Exposes References -
CVE-2026-86441
MISP Dashboard Organisation Widgets Bypass Organisation-Inde -
CVE-2026-86440
MISP Dashboard Button Widget Allows Stored XSS via Unsafe ja -
CVE-2026-86419
MISP Insufficient Outbound URL Validation Allows SSRF and Cr -
CVE-2026-86418
MISP Dashboard Organisation Picker Exposes Hidden Organisati
Same vendor: MISP
-
CVE-2026-86451
MISP Event Graph Object Reference Lookup Exposes References -
CVE-2026-86441
MISP Dashboard Organisation Widgets Bypass Organisation-Inde -
CVE-2026-86440
MISP Dashboard Button Widget Allows Stored XSS via Unsafe ja -
CVE-2026-86419
MISP Insufficient Outbound URL Validation Allows SSRF and Cr -
CVE-2026-86418
MISP Dashboard Organisation Picker Exposes Hidden Organisati
Same weakness: CWE-400
-
CVE-2026-86515
vgmstream txtp txtp_parser.c add_entry resource consumption -
CVE-2026-86511
java-json-tools jackson-coreutils JacksonUtils.java BigDecim -
CVE-2026-86319
java-json-tools json-patch Patch Operation JsonPatch.java Js -
CVE-2022-51018
PocketMine-MP before 3.26.5 Input Validation via Book Pages -
CVE-2026-86421
ImageMagick before 7.1.2-30 Memory Leak via MSL decoder
V. Comments for CVE-2026-86452
No comments yet