MISP up to 2.5.45 API Authentication Logging _shouldLog insufficient logging

Summaryinfo

A vulnerability classified as critical has been found in MISP up to 2.5.45. Affected by this vulnerability is the function _shouldLog of the component API Authentication Logging. Performing a manipulation results in insufficient logging. This vulnerability is identified as CVE-2026-92003. The attack can be initiated remotely. There is not any exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in MISP up to 2.5.45. It has been classified as critical. This affects the function _shouldLog of the component API Authentication Logging. The manipulation with an unknown input leads to a insufficient logging vulnerability. CWE is classifying the issue as CWE-778. When a security-critical event occurs, the product either does not record the event or omits important details about the event when logging it. This is going to have an impact on integrity, and availability. The summary by CVE is:

Affected versions of MISP do not consistently apply the existing authentication-failure logging throttle. Two API authentication failure branches wrote directly to the Log model:  - API requests with no authentication key;  - requests supplying an API key with an incorrect length Unlike other authentication failures, these paths bypassed _shouldLog(), so every request could create another durable auth_fail entry. Version affected: ≤2.5.45

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-92003 since 09/15/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1562.002 according to MITRE ATT&CK.

Upgrading to version 2.5.46 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Name

• MISP

Version

• 2.5.0
• 2.5.1
• 2.5.2
• 2.5.3
• 2.5.4
• 2.5.5
• 2.5.6
• 2.5.7
• 2.5.8
• 2.5.9
• 2.5.10
• 2.5.11
• 2.5.12
• 2.5.13
• 2.5.14
• 2.5.15
• 2.5.16
• 2.5.17
• 2.5.18
• 2.5.19
• 2.5.20
• 2.5.21
• 2.5.22
• 2.5.23
• 2.5.24
• 2.5.25
• 2.5.26
• 2.5.27
• 2.5.28
• 2.5.29
• 2.5.30
• 2.5.31
• 2.5.32
• 2.5.33
• 2.5.34
• 2.5.35
• 2.5.36
• 2.5.37
• 2.5.38
• 2.5.39
• 2.5.40
• 2.5.41
• 2.5.42
• 2.5.43
• 2.5.44
• 2.5.45

License

• open-source

Website

• Product: https://github.com/MISP/MISP/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion