OpenCTI CVE-2026-35210

Exploitation requires an authenticated OpenCTI account holding the KNOWLEDGE_KNUPDATE permission (knowledge-write), and the attacker must add the specific HTTP header 'synchronized-upsert: true' to update/upsert requests - that header is the exact trigger that bypasses Confidence Level validation and Object Marking enforcement on STIX objects such as Indicators, ThreatActors, Malware, and Reports. Limiting factors: it is not usable by fully unauthenticated attackers (PR:L requires a valid account with knowledge-update rights), so realistic risk centers on malicious insiders or compromised analyst credentials; it affects OpenCTI deployments running any version prior to 7.260326.0 and provides data-integrity/marking manipulation rather than code execution or full data theft.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N, base 7.1) reflects the real shape of the risk well: network-reachable, low complexity, no user interaction, but requiring an authenticated account with the KNOWLEDGE_KNUPDATE knowledge-write permission. Impact is integrity-dominant (I:H) - attackers corrupt threat-intel data and remove markings - with limited confidentiality exposure (C:L) arising from stripping TLP:RED and no availability impact. This is a meaningful priority for organizations running OpenCTI as a shared, multi-tenant intel store, since it undermines the trustworthiness of the intelligence other teams consume, but it is not a mass-exploitation, pre-auth RCE scenario. No EPSS score, SSVC decision, KEV entry, or public POC was provided in the input, so exploitation-likelihood signals are absent rather than low; risk should be judged primarily on the requirement for a semi-trusted authenticated insider or a compromised analyst account. The provided CVSS marks C:L while the primary described effect is integrity/marking manipulation - the confidentiality element depends on marking-removal leading to downstream over-sharing, which is plausible but secondary.

An analyst account (or a compromised low-trust user) that has KNOWLEDGE_KNUPDATE sends an otherwise normal update/upsert API request to the OpenCTI platform but adds the HTTP header 'synchronized-upsert: true'. The server skips Confidence Level and Object Marking checks, letting the attacker strip TLP:RED from a sensitive Indicator or Report, lower its confidence, and rewrite its relationships so downstream consumers ingest degraded or over-shared intelligence. No public POC was identified at time of analysis, but the technique is trivial to reproduce once the header behavior is known.