CVE-2026-86452: MISP Unauthenticated Mail Endpoints Allow Unbounded Storage Consumption and Request Flooding
Affected versions of MISP permit unauthenticated or weakly constrained request paths to perform persistent work without adequate input bounds or rate limiting.
The users/forgot password-reset endpoint accepted an attacker-controlled email value without first imposing a reasonable length bound or validating its format. That value was then used to create an audit log entry and queue a password-reset job, causing the supplied value to be persisted more than once per request. The commit explicitly states that an unbounded unauthenticated request field was stored twice per call with no throttle.
The fix adds:
- a maximum email input length of 1024 bytes; - email-format validation before persistent work; - a per-source pre-authentication request budget; - HTTP 429 responses when that budget is exceeded; - a 15-minute cooldown for API-access request emails; - POST-only handling and CSRF protection for the API-access request endpoint.
The new flood filter is specifically intended to limit persistent storage costs from anonymous requests such as password resets, registrations, and failed REST authentication attempts.
Version affected: ≤2.5.45
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MISPto a version that resolves this vulnerability.Fixed in ≤2.5.45 - Configuration
Add a per-source pre-authentication request budget to limit unauthenticated request flooding on persistent-work paths (e.g., password resets, registrations, failed REST auth attempts).
MISP (Mail/Password-reset endpoint: /users/forgot) per-source pre-authentication request budget = enforce (flood filter) - Configuration
Validate the submitted email format before creating audit log entries or queueing persistent jobs (persistent work must only occur after format validation).
MISP (Mail/Password-reset endpoint: /users/forgot) email-format validation before persistent work = enabled - Configuration
Ensure the API-access request endpoint accepts requests only via POST (reject other HTTP methods).
MISP (API-access request endpoint) POST-only handling = required - Configuration
Enable CSRF protection for the API-access request endpoint.
MISP (API-access request endpoint) CSRF protection = enabled - Configuration
Add a 15-minute cooldown on API-access request emails / password-reset emails to limit repeated requests from the same source.
MISP (Mail/Password-reset endpoint: /users/forgot) 15-minute cooldown for request emails = 15 minutes - Configuration
Impose a maximum email input length of 1024 bytes on attacker-controlled email inputs to prevent unbounded storage consumption.
MISP (Mail/Password-reset endpoint: /users/forgot) maximum email input length = 1024 bytes
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated attacker can target the password-reset flow, and the flood filter also covers anonymous registrations and failed REST authentication attempts. No existing account is required for the described password-reset abuse.
What impact can repeated requests have?
Each password-reset request can cause attacker-supplied email data to be persisted in an audit log and again through a queued password-reset job. Repeated requests can therefore consume persistent storage and flood application processing.
Which versions are affected?
MISP versions 2.5.45 and earlier are affected.
What protections does the fix add?
The fix limits email input to 1024 bytes, validates email format before persistent work, and applies a per-source pre-authentication request budget that returns HTTP 429 when exceeded. It also adds a 15-minute cooldown for API-access request emails and makes the API-access request endpoint POST-only with CSRF protection.
How can defenders identify attempted abuse?
Review password-reset, registration, and failed REST authentication activity for high request volumes from a single source, especially requests containing unusually long or malformed email values. On a fixed deployment, requests exceeding the pre-authentication budget should receive HTTP 429 responses.