MISP Access Log Entry Overwritten by Error Controller's Second beforeFilter Pass

published 2026-09-15 55 d ago modified 2026-09-16 54 d ago also EUVD-2026-78350

cvss: 5.3; version 4.0, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.5%; EPSS 0.5% chance of exploitation in 30 days, percentile 41%
public exploits: 0; none known

Affected versions of MISP can record incorrect access-log data for requests that terminate in an exception.

Because CakeErrorController extends AppController, exception rendering runs the application startup path a second time. As a result, __accessMonitor() calls AccessLog::logRequest() twice for one HTTP request. The second deferred writer measures the error-controller execution instead of the original request and can overwrite the row created by the first pass. The corrupted fields include request duration, SQL query count, memory usage, and potentially the recorded query log.

The bug was masked because the same model instance retained the ID of the first saved row, causing the later save to issue an UPDATE rather than insert an obvious duplicate row.

Version affected: ≤2.5.45

Patch / fix

fixed in 1 links 1

MISP MISP 2.5.46

github.com/MISP/MISP@0dae5c0 commit

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 55 d ago (2026-09-15)

Exploit prediction

0.47% chance of exploitation in the next 30 days, higher than 41% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	4.0	5.3	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
CNA	4.0	5.3	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

MISP MISP

Classification

Weakness

CWE-778 Insufficient Logging
CWE-223 Omission of Security-relevant Information

References

github.com /MISP/MISP/commit/0dae5c072
patch

Sources

CVE List CVE-2026-91859
NVD CVE-2026-91859

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary