Skip to content
OpenAdvisories
Medium WID-SEC-2026-3411 4 CVEs

MISP: Mehrere Schwachstellen

Published Sep 15, 2026 · Updated Sep 15, 2026 · de-DE

Summary

Ein Angreifer kann mehrere Schwachstellen in MISP ausnutzen, um Dateien zu manipulieren, Sicherheitsmaßnahmen zu umgehen oder einen Denial-of-Service-Zustand auszulösen.

Product

MISP ist eine Open-Source-Plattform für den Informationsaustausch über Bedrohungen.

Vulnerabilities 4

  • Medium 6.9
    CVE-2026-92003

    MISP Unthrottled Authentication Failure Log Writes Enable Resource Exhaustion

    Affected versions of MISP do not consistently apply the existing authentication-failure logging throttle. Two API authentication failure branches wrote directly to the Log model:  - API requests with no authentication key;  - requests supplying an API key wit…

    MISP MISP
  • Medium 5.3
    CVE-2026-91857

    MISP: State-changing actions accessible via GET request enabling CSRF

    Affected versions of MISP expose several state-changing controller actions without restricting them to POST. The affected actions are:  - EventReportsController::purgeUnusedPictures()  - NoticelistsController::enableNoticelist()  - ServersController::removeOr…

    MISP MISP
  • Medium 5.3
    CVE-2026-91859

    MISP Access Log Entry Overwritten by Error Controller's Second beforeFilter Pass

    Affected versions of MISP can record incorrect access-log data for requests that terminate in an exception. Because CakeErrorController extends AppController, exception rendering runs the application startup path a second time. As a result, __accessMonitor() …

    MISP MISP
  • Medium 5.1
    CVE-2026-92002

    MISP: Authentication failure logging suppressed during Redis unavailability

    Affected versions of MISP use Redis to throttle repeated authentication-failure log entries. The intent is to avoid excessive duplicate logs while still recording failed authentication activity. However, User->setupRedis() returns false when Redis cannot be r…

    MISP MISP

Revision history

  1. #1

    Initiale Fassung

References