Medium · CVSS 5.3CVE-2026-91859

MISP Access Log Entry Overwritten by Error Controller's Second beforeFilter PassCVE-2026-91859

Answer in brief

CVE-2026-91859 records a Medium severity (CVSS 5.3) vulnerability in MISP Access Log Entry Overwritten by Error Controller's Second beforeFilter Pass. The current sources do not mark it as known exploited. The current feed maps MISP/MISP (generic). Check affected ranges and fixed versions before updating.

Analysis pending evidence review

HOL Guard separates source facts from reviewed analysis. See the methodology.

Published Sep 15, 2026Updated Sep 16, 2026Source checked Oct 31, 2026First seen by HOL Sep 15, 2026Material review Sep 16, 2026

Upstream Advisory

Key facts

Risk: Medium · CVSS 5.3
Exploitation: Not marked as known exploited
Affected software: 1 mapped package or product
Fix availability: Available

Why this deserves its current priority

CVSS is 5.3. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps MISP/MISP (generic). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
MISP/MISPgeneric	>=0 <2.5.46	2.5.46

Recommended response

Check inventory. Check lockfiles and deployed manifests for MISP/MISP.
Review the reported fix. Source-reported solution: The fix introduces a per-instance boolean guard ($deferredWriterRegistered) in the AccessLog model so that logRequest() returns early on the second beforeFilter pass, preventing the error controller from overwriting the original request's log entry. Additionally, a $this->create() call is added before $this->save() in saveOnShutdown() to ensure each save issues an INSERT rather than an UPDATE, providing defense-in-depth against accidental row mutation.

Evidence timeline and material changes

Published upstream
Sep 15, 2026
Evidence: source:cvelist:source_dates:source-dates:record
Source modified
Sep 16, 2026
Evidence: source:cvelist:source_dates:source-dates:record
First seen by HOL
Sep 15, 2026

Sources and claim methodology

GitHub security advisorygithub.com

Upstream source description

Affected versions of MISP can record incorrect access-log data for requests that terminate in an exception. Because CakeErrorController extends AppController, exception rendering runs the application startup path a second time. As a result, __accessMonitor() calls AccessLog::logRequest() twice for one HTTP request. The second deferred writer measures the error-controller execution instead of the original request and can overwrite the row created by the first pass. The corrupted fields include request duration, SQL query count, memory usage, and potentially the recorded query log. The bug was masked because the same model instance retained the ID of the first saved row, causing the later save to issue an UPDATE rather than insert an obvious duplicate row. Version affected: ≤2.5.45

Quoted source text, attributed separately from HOL analysis.

Package

Affected range

Fixed version

MISP/MISPgeneric

>=0 <2.5.46

2.5.46

Recommended response

Check inventory. Check lockfiles and deployed manifests for MISP/MISP.

Review the reported fix. Source-reported solution: The fix introduces a per-instance boolean guard ($deferredWriterRegistered) in the AccessLog model so that logRequest() returns early on the second beforeFilter pass, preventing the error controller from overwriting the original request's log entry. Additionally, a $this->create() call is added before $this->save() in saveOnShutdown() to ensure each save issues an INSERT rather than an UPDATE, providing defense-in-depth against accidental row mutation.

Sources and claim methodology

Upstream source description

Quoted source text, attributed separately from HOL analysis.