CVE-2026-86452

Name of the Vulnerable Software and Affected Versions MISP versions prior to 2.5.46

Description Unauthenticated or weakly constrained request paths allow persistent work without adequate input bounds or rate limiting. Specifically, the '/users/forgot password-reset' endpoint accepts an attacker-controlled email value without validating its format or imposing a reasonable length bound. This value is used to create an audit log entry and queue a password-reset job, resulting in the unbounded field being persisted multiple times per request without throttling. This can lead to excessive persistent storage costs from anonymous requests, including password resets, registrations, and failed REST authentication attempts.

Recommendations Update to version 2.5.46 or later. As a temporary mitigation, restrict access to the '/users/forgot password-reset' endpoint to minimize the risk of exploitation.