Vulnerability · Published Sep 15, 2026 · Assigned by CIRCL
CVE-2026-91859MISP Access Log Entry Overwritten by Error Controller's Second beforeFilter Pass
Medium 5.3
In plain English
A medium-severity security flaw in MISP from MISP. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).
Official description
Affected versions of MISP can record incorrect access-log data for requests that terminate in an exception. Because CakeErrorController extends AppController, exception rendering runs the application startup path a second time. As a result, __accessMonitor() calls AccessLog::logRequest() twice for one HTTP request. The second deferred writer measures the error-controller execution instead of the original request and can overwrite the row created by the first pass. The corrupted fields include request duration, SQL query count, memory usage, and potentially the recorded query log. The bug was masked because the same model instance retained the ID of the first saved row, causing the later save to issue an UPDATE rather than insert an obvious duplicate row. Version affected: ≤2.5.45
Affected products (as reported)
Weakness: CWE-778, CWE-223 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
References
- Security patch patch