{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-92003", "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "state": "PUBLISHED", "assignerShortName": "CIRCL", "dateReserved": "2026-09-15T11:43:17.522Z", "datePublished": "2026-09-15T11:43:19.403Z", "dateUpdated": "2026-09-15T12:32:06.515Z"}, "containers": {"cna": {"affected": [{"modules": ["app/Controller/AppController.php"], "product": "MISP", "programFiles": ["app/Controller/AppController.php"], "repo": "https://github.com/MISP/MISP", "vendor": "MISP", "versions": [{"lessThan": "2.5.46", "status": "affected", "version": "0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "remediation developer", "value": "iglocska"}, {"lang": "en", "type": "remediation developer", "value": "Claude Opus 5 (1M context)"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Affected versions of MISP do not consistently apply the existing authentication-failure logging throttle.</p>\n<p>Two API authentication failure branches wrote directly to the <code>Log</code> model:</p>\u2003- API requests with <strong>no authentication key</strong>;<br><div>\u2003- requests supplying an API key with an <strong>incorrect length</strong></div><div><strong><br></strong></div><p>Unlike other authentication failures, these paths bypassed <code>_shouldLog()</code>, so every request could create another durable <code>auth_fail</code> entry.</p>Version affected: \u22642.5.45<br>"}], "value": "Affected versions of MISP do not consistently apply the existing authentication-failure logging throttle.\n\n\nTwo API authentication failure branches wrote directly to the Log model:\n\n\u2003- API requests with no authentication key;\n\u2003- requests supplying an API key with an incorrect length\n\n\n\n\nUnlike other authentication failures, these paths bypassed _shouldLog(), so every request could create another durable auth_fail entry.\n\nVersion affected: \u22642.5.45"}], "impacts": [{"capecId": "CAPEC-125", "descriptions": [{"lang": "en", "value": "CAPEC-125 Flooding"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 6.9, "baseSeverity": "MEDIUM", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-770", "description": "CWE-770 Allocation of Resources Without Limits or Throttling", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-400", "description": "CWE-400 Uncontrolled Resource Consumption", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "shortName": "CIRCL", "dateUpdated": "2026-09-15T11:43:19.403Z"}, "references": [{"name": "Security patch", "tags": ["patch"], "url": "https://github.com/MISP/MISP/commit/2bf887433"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>The fix applies the existing hourly per-key log throttle to the two previously unguarded authentication-failure log writes. The throttle key is now derived from the client's source IP address rather than from caller-supplied input, preventing an attacker from generating unbounded Redis throttle entries. A per-request memo (stored in Configure::read('CurrentRequestAuthFailKeys')) is added to _shouldLog() to prevent duplicate log entries when beforeFilter() executes a second time via CakeErrorController on an exception, ensuring one request produces at most one log entry per key regardless of the operator's log_each_individual_auth_fail setting.</p>"}], "value": "The fix applies the existing hourly per-key log throttle to the two previously unguarded authentication-failure log writes. The throttle key is now derived from the client's source IP address rather than from caller-supplied input, preventing an attacker from generating unbounded Redis throttle entries. A per-request memo (stored in Configure::read('CurrentRequestAuthFailKeys')) is added to _shouldLog() to prevent duplicate log entries when beforeFilter() executes a second time via CakeErrorController on an exception, ensuring one request produces at most one log entry per key regardless of the operator's log_each_individual_auth_fail setting."}], "title": "MISP Unthrottled Authentication Failure Log Writes Enable Resource Exhaustion", "x_gcve": [{"extensions": {"bcp-05-x-01": {"ai_annotations": [{"ai_level": "generated", "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.", "gna_source": 1, "models": [{"gna_source": 1, "identifier": "qwen3.8:27b", "name": "qwen3.8:27b", "source": "ollama"}], "review_status": "review", "scope": "record", "tags": ["ai-computer-assisted:llm-generated", "ai-computer-assisted:classification"]}]}, "bcp-05-x-02": {"x_patch2vuln": {"assumptions": ["The tag_version_boundary (v2.5.46, 188 commits after fix) is used as an approximate upper bound for affected versions; the exact fixed release tag is not stated in the patch metadata.", "The log entries are written to a relational database (MySQL/PostgreSQL) via MISP's Log model, based on the createLogEntry() call pattern; the specific backend is not confirmed in the patch.", "The Redis instance used for throttling is assumed to be co-located with the MISP application; a Redis outage degrades to logging everything (fail-open), which is a design choice documented in the patch comments.", "CVSS VA:H assumes that sustained unthrottled log writes can exhaust storage or I/O capacity sufficient to degrade or halt the MISP service; actual impact depends on deployment sizing and disk capacity."], "commit": "2bf8874336518d8c5ef6a42e51e78900ec242630", "confidence": "medium", "credits": [{"lang": "en", "type": "remediation developer", "value": "iglocska"}, {"lang": "en", "type": "remediation developer", "value": "Claude Opus 5 (1M context)"}], "cvssRationale": "The vulnerable paths are reachable over the network (AV:N) with no authentication (PR:N) and no user interaction (UI:N). The attack complexity is low (AC:L): an attacker simply sends repeated HTTP requests to the MISP API without an API key or with a key of the wrong length. No attack target is required (AT:N). There is no impact on confidentiality (VC:N, SC:N) or integrity (VI:N, SI:N). The availability impact is high (VA:H) because unbounded log writes can exhaust database storage, degrade query performance, and ultimately make the MISP instance unavailable. No secondary availability impact (SA:N) is evident from the patch.", "draft": false, "fixSummary": "The fix applies the existing hourly per-key log throttle to the two previously unguarded authentication-failure log writes. The throttle key is now derived from the client's source IP address rather than from caller-supplied input, preventing an attacker from generating unbounded Redis throttle entries. A per-request memo (stored in Configure::read('CurrentRequestAuthFailKeys')) is added to _shouldLog() to prevent duplicate log entries when beforeFilter() executes a second time via CakeErrorController on an exception, ensuring one request produces at most one log entry per key regardless of the operator's log_each_individual_auth_fail setting.", "generatedAt": "2026-09-15T11:37:41.625192Z", "generator": "patch2vuln.py", "model": "qwen3.8:27b", "modelComparison": {"rankings": [{"agreementScore": 9, "assumptionCount": 4, "confidence": "medium", "model": "qwen3.8:27b", "score": 6}], "selectedModel": "qwen3.8:27b", "selectionMethod": "deterministic-consensus-v1", "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."}, "patchSha256": "db6f78e69079c91d4ba1dac46c4ed5b8ff1ca617c00cd6733bff926c0925a2e3", "patchSummary": "In app/Controller/AppController.php: (1) The 'no authkey' branch in beforeFilter() now calls _shouldLog('noauthkey:' . $this->User->_remoteIp()) before writing the log entry. (2) The 'incorrect length' branch in __loginByAuthKey() now calls _shouldLog('badauthkeylength:' . $this->User->_remoteIp()) before writing the log entry. (3) _shouldLog() is refactored to first check a per-request memo array (Configure 'CurrentRequestAuthFailKeys') to suppress duplicate logging across the double beforeFilter() invocation, then evaluate the log_each_individual_auth_fail setting, then fall through to the Redis EXISTS/SETEX 3600-second throttle, and finally record the key in the memo. The Redis-unavailable fallback (log everything) is preserved.", "patchTruncated": false, "patches": [{"commit": "2bf8874336518d8c5ef6a42e51e78900ec242630", "patchSha256": "db6f78e69079c91d4ba1dac46c4ed5b8ff1ca617c00cd6733bff926c0925a2e3", "source": "https://github.com/MISP/MISP/commit/2bf887433.patch", "sourceUrl": "https://github.com/MISP/MISP/commit/2bf887433.patch", "subject": "fix: [logging] Throttle the two unguarded auth_fail writes"}], "source": "https://github.com/MISP/MISP/commit/2bf887433.patch", "subject": "fix: [logging] Throttle the two unguarded auth_fail writes", "tagVersionBoundary": {"commits_after_fix": 188, "repository": "https://github.com/MISP/MISP", "tag": "v2.5.46", "version": "2.5.46", "version_type": "semver"}, "weaknessRationale": [{"cweId": "CWE-770", "rationale": "Two authentication-failure log write paths lacked any rate-limiting or throttling mechanism, allowing an unauthenticated remote attacker to generate an unbounded number of database log entries and exhaust storage or I/O resources. The fix adds the missing hourly per-key throttle."}, {"cweId": "CWE-400", "rationale": "The unthrottled log writes constitute uncontrolled consumption of database write capacity and disk storage, enabling a denial-of-service condition. CWE-770 is the more specific primary weakness; CWE-400 captures the broader resource-exhaustion impact."}]}}}, "recordType": "advisory", "vulnId": "GCVE-1-2026-20158"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-15T12:31:54.934768Z", "id": "CVE-2026-92003", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-15T12:32:06.515Z"}}]}}

{}

{"affected": [{"affectedData": [{"modules": ["app/Controller/AppController.php"], "product": "MISP", "programFiles": ["app/Controller/AppController.php"], "repo": "https://github.com/MISP/MISP", "vendor": "MISP", "versions": [{"lessThan": "2.5.46", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Affected versions of MISP do not consistently apply the existing authentication-failure logging throttle.\n\n\nTwo API authentication failure branches wrote directly to the Log model:\n\n\u2003- API requests with no authentication key;\n\u2003- requests supplying an API key with an incorrect length\n\n\n\n\nUnlike other authentication failures, these paths bypassed _shouldLog(), so every request could create another durable auth_fail entry.\n\nVersion affected: \u22642.5.45"}], "id": "CVE-2026-92003", "lastModified": "2026-09-15T12:17:55.757", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "type": "Secondary"}]}, "published": "2026-09-15T12:17:55.757", "references": [{"source": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "url": "https://github.com/MISP/MISP/commit/2bf887433"}], "sourceIdentifier": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-400"}, {"lang": "en", "value": "CWE-770"}], "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "type": "Secondary"}]}

{}

{}