---
id: CVE-2026-86452
title: >-
  Affected versions of MISP permit unauthenticated or weakly constrained request
  paths to perform persistent work without adequate input bounds or rate
  limiting.



  The users/forgot password-reset endpoint accepted an attacker-controlled em…
summary: >-
  Affected versions of MISP permit unauthenticated or weakly constrained request
  paths to perform persistent work without adequate input bounds or rate
  limiting.



  The users/forgot password-reset endpoint accepted an attacker-controlled em…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-400
  - CWE-770
vendor: misp-project
product: misp
affected:
  - misp <= 2.5.45
published: '2026-09-07'
updated: '2026-09-14'
sourceUpdated: '2026-09-14T07:17:23.740'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-86452'
references:
  - url: 'https://github.com/MISP/MISP/commit/d75d899be'
    label: 5a6e4751-2f3f-4070-9419-94fb35b644e8
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-08T14:46:49.701592Z'
scores:
  nvd: 7.5
  cna: 8.7
epss: 0.00542
epssPercentile: 0.431
ingestedAt: '2026-09-08T15:33:26.978Z'
---

## Overview

Affected versions of MISP permit unauthenticated or weakly constrained request paths to perform persistent work without adequate input bounds or rate limiting.


The users/forgot password-reset endpoint accepted an attacker-controlled email value without first imposing a reasonable length bound or validating its format. That value was then used to create an audit log entry and queue a password-reset job, causing the supplied value to be persisted more than once per request. The commit explicitly states that an unbounded unauthenticated request field was stored twice per call with no throttle.

The fix adds:

 - a maximum email input length of 1024 bytes;
 - email-format validation before persistent work;
 - a per-source pre-authentication request budget;
 - HTTP 429 responses when that budget is exceeded;
 - a 15-minute cooldown for API-access request emails;
 - POST-only handling and CSRF protection for the API-access request endpoint.



The new flood filter is specifically intended to limit persistent storage costs from anonymous requests such as password resets, registrations, and failed REST authentication attempts.

Version affected: ≤2.5.45

## Affected

- `misp <= 2.5.45`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.