{"id":"CVE-2026-92003","title":"Affected versions of MISP do not consistently apply the existing authentication-failure logging throttle.\n\n\nTwo API authentication failure branches wrote directly to the Log model:\n\n - API requests with no authentication key;\n - requests…","summary":"Affected versions of MISP do not consistently apply the existing authentication-failure logging throttle.\n\n\nTwo API authentication failure branches wrote directly to the Log model:\n\n - API requests with no authentication key;\n - requests…","severity":"medium","cvss":6.9,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","cwe":["CWE-400","CWE-770"],"vendor":"MISP","product":"MISP","affected":["MISP < 2.5.46"],"published":"2026-09-15","updated":"2026-09-16","sourceUpdated":"2026-09-16T13:42:48.523","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-92003","references":[{"url":"https://github.com/MISP/MISP/commit/2bf887433","label":"5a6e4751-2f3f-4070-9419-94fb35b644e8"}],"tags":["nvd","cve.org"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-09-15T12:31:54.934768Z"},"cvssSource":"cna","ingestedAt":"2026-09-15T12:36:50.174Z","epss":0.00442,"epssPercentile":0.37693,"slug":"CVE-2026-92003","body":"## Overview\n\nAffected versions of MISP do not consistently apply the existing authentication-failure logging throttle.\n\n\nTwo API authentication failure branches wrote directly to the Log model:\n\n - API requests with no authentication key;\n - requests supplying an API key with an incorrect length\n\n\n\n\nUnlike other authentication failures, these paths bypassed _shouldLog(), so every request could create another durable auth_fail entry.\n\nVersion affected: ≤2.5.45\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":38,"depthScoreParts":{"impact":38,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}