CVE-2026-91859: MISP Information Disclosure Vulnerability

CVE-2026-91859 Overview

MISP (Malware Information Sharing Platform) versions 2.5.45 and earlier record incorrect access-log data for HTTP requests that terminate in an exception. The CakeErrorController extends AppController, causing exception rendering to run the application startup path a second time. This results in __accessMonitor() invoking AccessLog::logRequest() twice for a single HTTP request. The second deferred writer measures the error-controller execution and overwrites the row created by the first pass, corrupting audit fields including request duration, SQL query count, memory usage, and the recorded query log. The issue is classified under [CWE-223] Omission of Security-Relevant Information.

Critical Impact
Access log integrity is compromised for failed requests, degrading forensic and audit reliability without producing obvious duplicate rows.

Affected Products

MISP versions ≤ 2.5.45
MISP AccessLog model (app/Model/AccessLog.php)
MISP AppController startup path invoked by CakeErrorController

Discovery Timeline

2026-09-15 - CVE-2026-91859 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-91859

Vulnerability Analysis

The defect resides in how MISP's access-logging flow interacts with CakePHP exception rendering. When a controller action raises an exception, ExceptionRenderer::_getController() instantiates CakeErrorController and calls startupProcess() to render the error page. Because CakeErrorController extends AppController, the beforeFilter() hook runs a second time and invokes __accessMonitor(), which registers another deferred writer through AccessLog::logRequest().

Both passes receive the same model instance from ClassRegistry. The instance retains the primary key of the row saved during the first pass. As a result, the second save() executes an UPDATE rather than an INSERT, silently overwriting the accurate metrics with values measured against the error controller's short execution window.

Root Cause

The root cause is missing idempotency around deferred-writer registration in AccessLog::logRequest(). There is no guard indicating that the current HTTP request has already registered a writer, so exception-driven re-entry into the application startup path double-registers the callback.

Attack Vector

An authenticated user with low privileges can trigger the flaw by issuing requests that reliably cause exceptions, such as malformed parameters against controller actions. Each such request produces a log entry whose duration, query count, and memory usage reflect the error controller rather than the real request. This weakens the audit trail available to investigators reviewing suspicious activity.

php

         }
     }
 
+    /**
+     * Whether this request has already registered its deferred writer.
+     *
+     * AppController::beforeFilter() runs twice for any request that ends in an
+     * exception: CakeErrorController extends AppController, and
+     * ExceptionRenderer::_getController() calls startupProcess() on it to render
+     * the error page. __accessMonitor() therefore reaches logRequest() twice for
+     * one HTTP request, and the second pass measured the error controller rather
+     * than the request - overwriting the real duration, query count, memory usage
+     * and query log on the row the first pass had already written.
+     *
+     * ClassRegistry hands back the same model instance to both passes, so an
+     * instance flag is enough to keep one row per request carrying the numbers
+     * the request actually produced.
+     *
+     * @var bool
+     */
+    private $deferredWriterRegistered = false;
+
     /**
      * @param array $user
      * @param string $remoteIp

Source: MISP commit 0dae5c072. The patch introduces the $deferredWriterRegistered instance flag so logRequest() registers the writer only once per HTTP request.

Detection Methods for CVE-2026-91859

Indicators of Compromise

Access-log rows for requests that ended in exceptions showing anomalously low request_duration, sql_query_count, or memory_peak values relative to peer requests.
Access-log entries where the recorded query log is empty or truncated despite the request originally hitting authenticated controller actions.
Bursts of exception-terminated requests from a single authenticated session correlating with unexplained gaps in audit metrics.

Detection Strategies

Compare MISP web-server access logs against the application access_logs table and flag entries where server-side duration and application-recorded duration diverge significantly.
Query the access_logs table for rows with response_code in the 4xx/5xx range and near-zero measured metrics.
Monitor for repeated exception-triggering requests from the same user account or IP that would otherwise leave sparse audit records.

Monitoring Recommendations

Forward MISP application and web-server logs to a centralized log platform and reconcile per-request metrics between the two sources.
Alert on sustained increases in exception-terminated requests, which both indicate abuse attempts and amplify the logging defect.
Track the installed MISP version across nodes and alert when any instance reports a version at or below 2.5.45.

How to Mitigate CVE-2026-91859

Immediate Actions Required

Upgrade MISP to a version that includes commit 0dae5c072 on app/Model/AccessLog.php.
Preserve existing access_logs data before upgrading so investigators can distinguish pre-patch entries from post-patch entries.
Restrict exception-inducing request patterns at the reverse proxy or web application firewall where feasible.

Patch Information

The upstream fix is available in the MISP repository as commit 0dae5c072. It adds a $deferredWriterRegistered boolean on the AccessLog model instance and returns early from logRequest() when the writer has already been registered for the current request. Because ClassRegistry returns the same model instance to both AppController startup passes, the instance-level flag is sufficient to guarantee one log row per request.

Workarounds

If patching is delayed, treat access-log fields for exception-terminated requests as unreliable and rely on upstream web-server logs for duration, status, and volume metrics.
Reduce exposure by limiting access to authenticated MISP users and hardening input validation on custom controller extensions to reduce exception frequency.
Increase log-retention on the fronting web server so a full request record exists independently of the MISP application log.

bash

# Verify the installed MISP version and confirm the patched AccessLog file is deployed
cd /var/www/MISP
git log --oneline app/Model/AccessLog.php | head -n 5
grep -n "deferredWriterRegistered" app/Model/AccessLog.php