EUVD-2026-42430Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
Network API with low complexity and no user interaction, but requires an authenticated KNOWLEDGE_KNUPDATE account (PR:L); impact is chiefly data integrity/marking tampering (I:H) with limited confidentiality from marking removal (C:L) and no availability effect.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
2DescriptionCVE.org
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260326.0, an authorization bypass vulnerability in OpenCTI allows any authenticated user with KNOWLEDGE_KNUPDATE permission to bypass Confidence Level validation and Object Marking restrictions by injecting the synchronized-upsert: true HTTP header, enabling attackers to downgrade confidence levels, remove security markings such as TLP:RED, manipulate relationships, and affect STIX object types including Indicators, ThreatActors, Malware, and Reports. This issue is fixed in version 7.260326.0.
AnalysisAI
Authorization bypass in OpenCTI prior to version 7.260326.0 lets any authenticated user holding the KNOWLEDGE_KNUPDATE permission override Confidence Level validation and Object Marking restrictions simply by adding the 'synchronized-upsert: true' HTTP header. Exploitation allows downgrading confidence levels, stripping security markings such as TLP:RED, and tampering with STIX objects (Indicators, Threat Actors, Malware, Reports) and their relationships. There is no public exploit identified at time of analysis, and the issue is not on CISA KEV; the fix is delivered in release 7.260326.0.
Technical ContextAI
OpenCTI is an open-source cyber threat intelligence (CTI) platform built around the STIX data model, using confidence levels and TLP-style Object Markings to govern data trust and dissemination. The flaw is a CWE-639 (Authorization Bypass Through User-Controlled Key / improperly enforced access control) issue: an internal synchronization code path, intended for platform-to-platform sync ('synchronized-upsert'), can be triggered by an ordinary client because the server honors a user-supplied HTTP header ('synchronized-upsert: true') instead of restricting that mode to trusted sync connectors. When that header is present, the normal Confidence Level and Marking validation logic is skipped during upsert, so the client-controlled request path effectively selects a privileged processing mode it should not be able to reach.
RemediationAI
Vendor-released patch: upgrade OpenCTI to 7.260326.0 or later, which enforces validation on the synchronized-upsert path (see release https://github.com/OpenCTI-Platform/opencti/releases/tag/7.260326.0, advisory GHSA-36fr-4m54-94mj at https://github.com/OpenCTI-Platform/opencti/security/advisories/GHSA-36fr-4m54-94mj, and fix PR https://github.com/OpenCTI-Platform/opencti/pull/14243). If immediate upgrade is not possible, reduce exposure by tightly restricting who holds the KNOWLEDGE_KNUPDATE permission to only trusted analysts and sync service accounts, since that capability is the precondition for exploitation; the trade-off is reduced ability for those users to legitimately edit knowledge. Where a reverse proxy fronts OpenCTI, consider stripping or rejecting client-supplied 'synchronized-upsert' headers on inbound requests from untrusted clients so only genuine internal sync traffic can set it, being careful not to break legitimate platform-to-platform synchronization connectors. Additionally, audit recent object/marking changes for unexpected confidence downgrades or removed TLP markings that may indicate prior abuse.
OpenCTI 3.3.1 is vulnerable to a directory traversal attack via the static/css endpoint. An unauthenticated attacker can
Unauthenticated attackers can escalate privileges in OpenCTI 6.6.0-6.9.12 by impersonating any user account, including t
OpenCTI 3.3.1 is vulnerable to a reflected cross-site scripting (XSS) attack via the /graphql endpoint. An attacker can
OpenCTI is an open cyber threat intelligence (CTI) platform. Rated critical severity (CVSS 9.1), this vulnerability is r
Server-Side Template Injection in OpenCTI notifier templates allows privileged administrators with 'Manage customization
OpenCTI is an open-source cyber threat intelligence platform. Rated high severity (CVSS 8.1), this vulnerability is remo
OpenCTI is an open source platform allowing organizations to manage their cyber threat intelligence knowledge and observ
In OpenCTI through 5.2.4, a broken access control vulnerability has been identified in the profile endpoint. Rated high
Privilege escalation in OpenCTI prior to 6.9.7 allows an organization admin to gain elevated platform-wide privileges by
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.
Elasticsearch Painless script injection via OpenCTI's GraphQL API allows any authenticated user holding the KNOWLEDGE ca
OpenCTI versions prior to 6.9.1 contain an authorization bypass vulnerability in the GraphQL mutation 'IndividualDeletio
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today