What is GHSA-rr6q-fmv4-p23m?

GHSA-rr6q-fmv4-p23m is a security advisory published by GitHub Security Advisories with Medium severity. Affected versions of MISP do not consistently apply the existing authentication-failure logging...

Which CVE IDs does GHSA-rr6q-fmv4-p23m cover?

GHSA-rr6q-fmv4-p23m covers the following CVE IDs: CVE-2026-92003. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

GHSA-rr6q-fmv4-p23mMedium

Affected versions of MISP do not consistently apply the existing authentication-failure logging...

Vendor

GitHub Security Advisories

Published

September 15, 2026

Last Modified

September 15, 2026

🔗 CVE IDs covered (1)

CVE-2026-92003 →

📋 Description

Affected versions of MISP do not consistently apply the existing authentication-failure logging throttle.

Two API authentication failure branches wrote directly to the Log model:

- API requests with no authentication key; - requests supplying an API key with an incorrect length

Unlike other authentication failures, these paths bypassed _shouldLog(), so every request could create another durable auth_fail entry.

Version affected: ≤2.5.45

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-92003
https://github.com/MISP/MISP/commit/2bf887433
https://github.com/advisories/GHSA-rr6q-fmv4-p23m