EUVD-2026-42430Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
Network API with low complexity and no user interaction, but requires an authenticated KNOWLEDGE_KNUPDATE account (PR:L); impact is chiefly data integrity/marking tampering (I:H) with limited confidentiality from marking removal (C:L) and no availability effect.
Primary rating from Vendor (github).
CVSS VectorVendor: github
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
Lifecycle Timeline
2DescriptionCVE.org
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260326.0, an authorization bypass vulnerability in OpenCTI allows any authenticated user with KNOWLEDGE_KNUPDATE permission to bypass Confidence Level validation and Object Marking restrictions by injecting the synchronized-upsert: true HTTP header, enabling attackers to downgrade confidence levels, remove security markings such as TLP:RED, manipulate relationships, and affect STIX object types including Indicators, ThreatActors, Malware, and Reports. This issue is fixed in version 7.260326.0.
AnalysisAI
Authorization bypass in OpenCTI prior to version 7.260326.0 lets any authenticated user holding the KNOWLEDGE_KNUPDATE permission override Confidence Level validation and Object Marking restrictions simply by adding the 'synchronized-upsert: true' HTTP header. Exploitation allows downgrading confidence levels, stripping security markings such as TLP:RED, and tampering with STIX objects (Indicators, Threat Actors, Malware, Reports) and their relationships. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated OpenCTI account holding the KNOWLEDGE_KNUPDATE permission (knowledge-write), and the attacker must add the specific HTTP header 'synchronized-upsert: true' to update/upsert requests - that header is the exact trigger that bypasses Confidence Level validation and Object Marking enforcement on STIX objects such as Indicators, ThreatActors, Malware, and Reports. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N, base 7.1) reflects the real shape of the risk well: network-reachable, low complexity, no user interaction, but requiring an authenticated account with the KNOWLEDGE_KNUPDATE knowledge-write permission. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An analyst account (or a compromised low-trust user) that has KNOWLEDGE_KNUPDATE sends an otherwise normal update/upsert API request to the OpenCTI platform but adds the HTTP header 'synchronized-upsert: true'. The server skips Confidence Level and Object Marking checks, letting the attacker strip TLP:RED from a sensitive Indicator or Report, lower its confidence, and rewrite its relationships so downstream consumers ingest degraded or over-shared intelligence. … |
| Remediation | Vendor-released patch: upgrade OpenCTI to 7.260326.0 or later, which enforces validation on the synchronized-upsert path (see release https://github.com/OpenCTI-Platform/opencti/releases/tag/7.260326.0, advisory GHSA-36fr-4m54-94mj at https://github.com/OpenCTI-Platform/opencti/security/advisories/GHSA-36fr-4m54-94mj, and fix PR https://github.com/OpenCTI-Platform/opencti/pull/14243). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all OpenCTI instances, current versions, and audit users with KNOWLEDGE_KNUPDATE permission. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
OpenCTI 3.3.1 is vulnerable to a directory traversal attack via the static/css endpoint. An unauthenticated attacker can
Unauthenticated attackers can escalate privileges in OpenCTI 6.6.0-6.9.12 by impersonating any user account, including t
OpenCTI 3.3.1 is vulnerable to a reflected cross-site scripting (XSS) attack via the /graphql endpoint. An attacker can
OpenCTI is an open cyber threat intelligence (CTI) platform. Rated critical severity (CVSS 9.1), this vulnerability is r
OpenCTI is an open-source cyber threat intelligence platform. Rated high severity (CVSS 8.1), this vulnerability is remo
OpenCTI is an open source platform allowing organizations to manage their cyber threat intelligence knowledge and observ
In OpenCTI through 5.2.4, a broken access control vulnerability has been identified in the profile endpoint. Rated high
Privilege escalation in OpenCTI prior to 6.9.7 allows an organization admin to gain elevated platform-wide privileges by
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.
Elasticsearch Painless script injection via OpenCTI's GraphQL API allows any authenticated user holding the KNOWLEDGE ca
OpenCTI versions prior to 6.9.1 contain an authorization bypass vulnerability in the GraphQL mutation 'IndividualDeletio
OpenCTI is an open-source cyber threat intelligence platform. Rated medium severity (CVSS 6.3), this vulnerability is re
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today