CVE-2026-86452: MISP Unauthenticated Mail Endpoints Allow Unbounded Storage Consumption and Request Flooding
Affected versions of MISP permit unauthenticated or weakly constrained request paths to perform persistent work without adequate input bounds or rate limiting.
The users/forgot password-reset endpoint accepted an attacker-controlled email value without first imposing a reasonable length bound or validating its format. That value was then used to create an audit log entry and queue a password-reset job, causing the supplied value to be persisted more than once per request. The commit explicitly states that an unbounded unauthenticated request field was stored twice per call with no throttle.
The fix adds:
a maximum email input length of 1024 bytes;
email-format validation before persistent work;
a per-source pre-authentication request budget;
HTTP 429 responses when that budget is exceeded;
a 15-minute cooldown for API-access request emails;
POST-only handling and CSRF protection for the API-access request endpoint.
The new flood filter is specifically intended to limit persistent storage costs from anonymous requests such as password resets, registrations, and failed REST authentication attempts.
Version affected: ≤2.5.45
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MISPto a version that resolves this vulnerability.Fixed in 2.5.45 - Configuration
Add a 15-minute cooldown for API-access request emails to prevent repeated unauthenticated request flooding.
MISP API-access request emails (users/forgot password-reset endpoint) API-access request email cooldown = 15 minutes - Configuration
Enforce a maximum email input length of 1024 bytes before accepting the attacker-controlled email value.
MISP users/forgot password-reset endpoint max email input length = 1024 bytes - Configuration
Implement a per-source pre-authentication request budget to throttle anonymous requests before persistent work (e.g., password reset/logging/queueing) is performed.
MISP pre-authentication request handling per-source pre-authentication request budget = (unspecified in material) - Configuration
Validate email format before creating audit log entries or queueing password-reset jobs/persistent work.
MISP users/forgot password-reset endpoint email format validation = validated before persistent work - Compensating control
Use the new flood filter to limit persistent storage costs from anonymous requests such as password resets, registrations, and failed REST authentication attempts.
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated attacker can target the password-reset flow, and the flood filter also covers anonymous registrations and failed REST authentication attempts. No existing account is required for the described password-reset abuse.
What impact can repeated requests have?
Each password-reset request can cause attacker-supplied email data to be persisted in an audit log and again through a queued password-reset job. Repeated requests can therefore consume persistent storage and flood application processing.
Which versions are affected?
MISP versions 2.5.45 and earlier are affected.
What protections does the fix add?
The fix limits email input to 1024 bytes, validates email format before persistent work, and applies a per-source pre-authentication request budget that returns HTTP 429 when exceeded. It also adds a 15-minute cooldown for API-access request emails and makes the API-access request endpoint POST-only with CSRF protection.
How can defenders identify attempted abuse?
Review password-reset, registration, and failed REST authentication activity for high request volumes from a single source, especially requests containing unusually long or malformed email values. On a fixed deployment, requests exceeding the pre-authentication budget should receive HTTP 429 responses.