Vulnerability-Lookup

GHSA-QX5F-75HG-MF2C

Vulnerability from github – Published: 2026-09-15 12:31 – Updated: 2026-09-15 12:31

Details

Affected versions of MISP can record incorrect access-log data for requests that terminate in an exception.

Because CakeErrorController extends AppController, exception rendering runs the application startup path a second time. As a result, __accessMonitor() calls AccessLog::logRequest() twice for one HTTP request. The second deferred writer measures the error-controller execution instead of the original request and can overwrite the row created by the first pass. The corrupted fields include request duration, SQL query count, memory usage, and potentially the recorded query log.

The bug was masked because the same model instance retained the ID of the first saved row, causing the later save to issue an UPDATE rather than insert an obvious duplicate row.

Version affected: ≤2.5.45

Severity

5.3 (Medium)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-91859"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-223"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-15T10:17:06Z",
    "severity": "MODERATE"
  },
  "details": "Affected versions of MISP can record incorrect access-log data for requests that terminate in an exception.\n\n\nBecause CakeErrorController extends AppController, exception rendering runs the application startup path a second time. As a result, __accessMonitor() calls AccessLog::logRequest() twice for one HTTP request. The second deferred writer measures the error-controller execution instead of the original request and can overwrite the row created by the first pass. The corrupted fields include request duration, SQL query count, memory usage, and potentially the recorded query log.\n\n\nThe bug was masked because the same model instance retained the ID of the first saved row, causing the later save to issue an UPDATE rather than insert an obvious duplicate row.\n\nVersion affected: \u22642.5.45",
  "id": "GHSA-qx5f-75hg-mf2c",
  "modified": "2026-09-15T12:31:46Z",
  "published": "2026-09-15T12:31:46Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91859"
    },
    {
      "type": "WEB",
      "url": "https://github.com/MISP/MISP/commit/0dae5c072"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

CVE-2026-91859 (GCVE-0-2026-91859)

Vulnerability from cvelistv5 – Published: 2026-09-15 09:26 – Updated: 2026-09-15 13:05

Title

MISP Access Log Entry Overwritten by Error Controller's Second beforeFilter Pass

Summary

Affected versions of MISP can record incorrect access-log data for requests that terminate in an exception. Because CakeErrorController extends AppController, exception rendering runs the application startup path a second time. As a result, __accessMonitor() calls AccessLog::logRequest() twice for one HTTP request. The second deferred writer measures the error-controller execution instead of the original request and can overwrite the row created by the first pass. The corrupted fields include request duration, SQL query count, memory usage, and potentially the recorded query log. The bug was masked because the same model instance retained the ID of the first saved row, causing the later save to issue an UPDATE rather than insert an obvious duplicate row. Version affected: ≤2.5.45

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-15 13:04 UTC

CWE

CWE-778 - Insufficient Logging
CWE-223 - Omission of Security-relevant Information in Logs

Assigner

CIRCL ENISA root

References

1 reference

URL	Tags
https://github.com/MISP/MISP/commit/0dae5c072	patch

Impacted products

1 product

Vendor	Product	Version
MISP	MISP	Affected: 0 , < 2.5.46 (semver)

Credits

iglocska Claude Opus 5 (1M context)

GCVE extensions

AI-generated Confidence: medium Model qwen3.8:27b advisory bcp-05-x-01bcp-05-x-02

AI involvement GCVE-BCP-05-X-01

Whole record AI-generated Review: review GNA-1

Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.

ai-computer-assisted:llm-generatedai-computer-assisted:classification

Model	Source	Identifier
qwen3.8:27b	ollama	`qwen3.8:27b`

Patch provenance GCVE-BCP-05-X-02

Generator: patch2vuln.py on 2026-09-15 09:22
Model: qwen3.8:27b
Input: https://github.com/MISP/MISP/commit/0dae5c072.patch 4eeecd38b5b8…
Confidence: medium

Commit	Subject	Patch SHA-256
`0dae5c072d86`	fix: [logging] Stop the error controller overwriting the	`4eeecd38b5b8…`

Fix summary

The fix introduces a per-instance boolean guard ($deferredWriterRegistered) in the AccessLog model so that logRequest() returns early on the second beforeFilter pass, preventing the error controller from overwriting the original request's log entry. Additionally, a $this->create() call is added before $this->save() in saveOnShutdown() to ensure each save issues an INSERT rather than an UPDATE, providing defense-in-depth against accidental row mutation.

Patch summary

In app/Model/AccessLog.php: (1) Added a private $deferredWriterRegistered property (default false). (2) At the top of logRequest(), added an early-return guard: if $this->deferredWriterRegistered is true, return true immediately. (3) Set $this->deferredWriterRegistered = true immediately before register_shutdown_function() so the flag is latched on the first pass. (4) In saveOnShutdown(), added $this->create() before $this->save() to force a new-row INSERT and prevent the model from issuing an UPDATE against a previously saved id. (5) Added explanatory doc-comments describing the double-beforeFilter mechanism and the ClassRegistry single-instance behavior.

CVSS rationale

The vulnerability is exploitable over the network (AV:N) with low complexity (AC:L) by any authenticated user who can trigger an unhandled exception (e.g., via a malformed request). No attack target manipulation is required (AT:N). Low privileges are sufficient (PR:L) as any authenticated MISP user can cause an error. No user interaction is needed (UI:N). There is no direct confidentiality or availability impact on MISP itself (VC:N, VA:N). The integrity impact is low (VI:L) because the access-log row is overwritten with incorrect metrics rather than deleted, and only requests that trigger exceptions are affected. No secondary impacts are identified (SC:N, SI:N, SA:N). The overall severity is low, reflecting a logging-integrity weakness that degrades audit reliability but does not directly expose data or disrupt service.

Weakness rationale

CWE-778 The access-log mechanism fails to preserve accurate, immutable records of each request. The second beforeFilter pass overwrites the first pass's data, so the log does not faithfully reflect the actual request's duration, query count, memory usage, or SQL activity. This constitutes insufficient logging because the security-relevant audit data is corrupted rather than simply missing.
CWE-223 The genuine request metrics (duration, query count, memory, query log) are replaced by the error controller's metrics, effectively omitting the security-relevant information that the original request produced. This is a secondary mapping; CWE-778 is the primary weakness.

Assumptions to verify

MISP requires authentication for the operations that produce access-log entries; PR:L assumes a low-privilege authenticated user can trigger an unhandled exception.
The affected version range is inferred from the tag_version_boundary (v2.5.46, 190 commits after fix); the exact first-affected and last-affected versions are not stated in the patch metadata.
The security impact is limited to log-integrity degradation; no direct data exfiltration, privilege escalation, or denial-of-service is evidenced by the patch.
The double beforeFilter invocation is a CakePHP framework behavior (ExceptionRenderer::_getController calling startupProcess on CakeErrorController) and is not itself a MISP vulnerability, but MISP's AccessLog model did not guard against it.

Model comparison

Selected qwen3.8:27b by deterministic-consensus-v1
The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required.

Model	Score	Agreement	Confidence	Assumptions
`qwen3.8:27b`	6	9	medium	4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-91859",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-15T13:04:57.329720Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-15T13:05:17.132Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "modules": [
            "app/Model/AccessLog.php"
          ],
          "product": "MISP",
          "programFiles": [
            "app/Model/AccessLog.php"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.46",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 5 (1M context)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e\u003c/p\u003e\u003cp\u003eAffected versions of MISP can record incorrect access-log data for requests that terminate in an exception.\u003c/p\u003e\n\u003cp\u003eBecause \u003ccode\u003eCakeErrorController\u003c/code\u003e extends \u003ccode\u003eAppController\u003c/code\u003e, exception rendering runs the application startup path a second time. As a result, \u003ccode\u003e__accessMonitor()\u003c/code\u003e calls \u003ccode\u003eAccessLog::logRequest()\u003c/code\u003e twice for one HTTP request. The second deferred writer measures the error-controller execution instead of the original request and can overwrite the row created by the first pass. The corrupted fields include request duration, SQL query count, memory usage, and potentially the recorded query log.\u003c/p\u003e\n\u003cp\u003eThe bug was masked because the same model instance retained the ID of the first saved row, causing the later save to issue an \u003ccode\u003eUPDATE\u003c/code\u003e rather than insert an obvious duplicate row.\u003c/p\u003e\u003cp\u003eVersion affected: \u22642.5.45\u003cbr\u003e\u003c/p\u003e\u003cp\u003e\u003c/p\u003e"
            }
          ],
          "value": "Affected versions of MISP can record incorrect access-log data for requests that terminate in an exception.\n\n\nBecause CakeErrorController extends AppController, exception rendering runs the application startup path a second time. As a result, __accessMonitor() calls AccessLog::logRequest() twice for one HTTP request. The second deferred writer measures the error-controller execution instead of the original request and can overwrite the row created by the first pass. The corrupted fields include request duration, SQL query count, memory usage, and potentially the recorded query log.\n\n\nThe bug was masked because the same model instance retained the ID of the first saved row, causing the later save to issue an UPDATE rather than insert an obvious duplicate row.\n\nVersion affected: \u22642.5.45"
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-778",
              "description": "CWE-778 Insufficient Logging",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-223",
              "description": "CWE-223 Omission of Security-relevant Information in Logs",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-15T09:26:35.198Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/0dae5c072"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe fix introduces a per-instance boolean guard ($deferredWriterRegistered) in the AccessLog model so that logRequest() returns early on the second beforeFilter pass, preventing the error controller from overwriting the original request\u0027s log entry. Additionally, a $this-\u0026gt;create() call is added before $this-\u0026gt;save() in saveOnShutdown() to ensure each save issues an INSERT rather than an UPDATE, providing defense-in-depth against accidental row mutation.\u003c/p\u003e"
            }
          ],
          "value": "The fix introduces a per-instance boolean guard ($deferredWriterRegistered) in the AccessLog model so that logRequest() returns early on the second beforeFilter pass, preventing the error controller from overwriting the original request\u0027s log entry. Additionally, a $this-\u003ecreate() call is added before $this-\u003esave() in saveOnShutdown() to ensure each save issues an INSERT rather than an UPDATE, providing defense-in-depth against accidental row mutation."
        }
      ],
      "title": "MISP Access Log Entry Overwritten by Error Controller\u0027s Second beforeFilter Pass",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "review",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "MISP requires authentication for the operations that produce access-log entries; PR:L assumes a low-privilege authenticated user can trigger an unhandled exception.",
                  "The affected version range is inferred from the tag_version_boundary (v2.5.46, 190 commits after fix); the exact first-affected and last-affected versions are not stated in the patch metadata.",
                  "The security impact is limited to log-integrity degradation; no direct data exfiltration, privilege escalation, or denial-of-service is evidenced by the patch.",
                  "The double beforeFilter invocation is a CakePHP framework behavior (ExceptionRenderer::_getController calling startupProcess on CakeErrorController) and is not itself a MISP vulnerability, but MISP\u0027s AccessLog model did not guard against it."
                ],
                "commit": "0dae5c072d86e62140c385cf507135f196415fa6",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 5 (1M context)"
                  }
                ],
                "cvssRationale": "The vulnerability is exploitable over the network (AV:N) with low complexity (AC:L) by any authenticated user who can trigger an unhandled exception (e.g., via a malformed request). No attack target manipulation is required (AT:N). Low privileges are sufficient (PR:L) as any authenticated MISP user can cause an error. No user interaction is needed (UI:N). There is no direct confidentiality or availability impact on MISP itself (VC:N, VA:N). The integrity impact is low (VI:L) because the access-log row is overwritten with incorrect metrics rather than deleted, and only requests that trigger exceptions are affected. No secondary impacts are identified (SC:N, SI:N, SA:N). The overall severity is low, reflecting a logging-integrity weakness that degrades audit reliability but does not directly expose data or disrupt service.",
                "draft": false,
                "fixSummary": "The fix introduces a per-instance boolean guard ($deferredWriterRegistered) in the AccessLog model so that logRequest() returns early on the second beforeFilter pass, preventing the error controller from overwriting the original request\u0027s log entry. Additionally, a $this-\u003ecreate() call is added before $this-\u003esave() in saveOnShutdown() to ensure each save issues an INSERT rather than an UPDATE, providing defense-in-depth against accidental row mutation.",
                "generatedAt": "2026-09-15T09:22:08.485154Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 9,
                      "assumptionCount": 4,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 6
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "4eeecd38b5b824e3c5c1ae20886e62534ebed473410f59bea7276f83b32d4051",
                "patchSummary": "In app/Model/AccessLog.php: (1) Added a private $deferredWriterRegistered property (default false). (2) At the top of logRequest(), added an early-return guard: if $this-\u003edeferredWriterRegistered is true, return true immediately. (3) Set $this-\u003edeferredWriterRegistered = true immediately before register_shutdown_function() so the flag is latched on the first pass. (4) In saveOnShutdown(), added $this-\u003ecreate() before $this-\u003esave() to force a new-row INSERT and prevent the model from issuing an UPDATE against a previously saved id. (5) Added explanatory doc-comments describing the double-beforeFilter mechanism and the ClassRegistry single-instance behavior.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "0dae5c072d86e62140c385cf507135f196415fa6",
                    "patchSha256": "4eeecd38b5b824e3c5c1ae20886e62534ebed473410f59bea7276f83b32d4051",
                    "source": "https://github.com/MISP/MISP/commit/0dae5c072.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/0dae5c072.patch",
                    "subject": "fix: [logging] Stop the error controller overwriting the"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/0dae5c072.patch",
                "subject": "fix: [logging] Stop the error controller overwriting the",
                "tagVersionBoundary": {
                  "commits_after_fix": 190,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.46",
                  "version": "2.5.46",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-778",
                    "rationale": "The access-log mechanism fails to preserve accurate, immutable records of each request. The second beforeFilter pass overwrites the first pass\u0027s data, so the log does not faithfully reflect the actual request\u0027s duration, query count, memory usage, or SQL activity. This constitutes insufficient logging because the security-relevant audit data is corrupted rather than simply missing."
                  },
                  {
                    "cweId": "CWE-223",
                    "rationale": "The genuine request metrics (duration, query count, memory, query log) are replaced by the error controller\u0027s metrics, effectively omitting the security-relevant information that the original request produced. This is a secondary mapping; CWE-778 is the primary weakness."
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20138"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-91859",
    "datePublished": "2026-09-15T09:26:35.198Z",
    "dateReserved": "2026-09-15T09:26:32.260Z",
    "dateUpdated": "2026-09-15T13:05:17.132Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.