CVE Feed

    Dashboard / CVE / CVE-2026-92003

    CVE-2026-92003

    Affected versions of MISP do not consistently apply the existing authentication-failure logging throttle. Two API authentication failure branches wrote directly to the Log model:  - API requests with no authentication key;  - requests supplying an API key with an incorrect length Unlike other authentication failures, these paths bypassed _shouldLog(), so every request could create another durable auth_fail entry. Version affected: ≤2.5.45

    Published:Sep 15, 2026
    Last Modified:Sep 15, 2026
    EPS:Sep 15, 2026
    EPSS Score:
    CVSS Score:6.9

    Affected Products

    Vendor
    Misp
    Product
    Misp

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-112192 (CVSS 5.3) — MISP contains a vulnerability in the handling of module plugin settings. When the server rebuilds module-suppl…
    CVE-2026-112188 (CVSS 7.1) — MISP contains a vulnerability in its server settings lookup mechanism that allows an authenticated user to ret…
    CVE-2026-112184 (CVSS 4.8) — MISP contains a reflected cross-site scripting (XSS) vulnerability in the workflow module interface. Parameter…
    CVE-2026-112183 (CVSS 4.8) — MISP contains a CSS injection vulnerability in the remote event preview feature. When a user previews an event…
    CVE-2026-112180 (CVSS 5.1) — MISP contains a data integrity flaw in its event deletion logic. When a user deletes an event, several associa…
    CVE-2026-112179 (CVSS 5.3) — In MISP, the event synchronization process contained a logic error in the preparation of event reports for rem…
    CVE-2026-112178 (CVSS 7.1) — MISP contains an access control flaw in the proposal (shadow attribute) visibility logic. The authorization ch…
    CVE-2026-107278 (CVSS 5.3) — MISP contains a validation flaw in its object synchronization logic. When a MISP Object is created without a d…
    CVE-2026-107276 (CVSS 6.3) — MISP contains a race condition in the email-based one-time password (OTP) login flow. When two HTTP requests c…
    CVE-2026-107180 (CVSS 7.1) — On MISP instances configured to require TOTP enrolment (Security.otp_required), the enforcement of the mandato…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High