What is the CVSS score of CVE-2026-44730?

CVE-2026-44730 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of OpenCTI are affected by CVE-2026-44730?

OpenCTI versions prior to 6.9.7 contain a privilege escalation vulnerability in the userEdit GraphQL mutation that allows organization administrators to gain platform-wide access by exploiting…. A patch is available.

How to fix or mitigate CVE-2026-44730?

Within 24 hours: identify all OpenCTI instances, document current versions, and determine if multi-organization mode is enabled. Within 7 days: plan and schedule upgrades to OpenCTI 6.9.7 or later across all affected instances, prioritizing production systems. Within 30 days: complete all upgrades, validate GraphQL ACL enforcement on userEdit mutations, and conduct audit of recent admin role additions for unauthorized cross-organization privilege grants.

OpenCTI CVE-2026-44730

EUVD-2026-31908 HIGH

Improper Access Control (CWE-284)

2026-05-26 GitHub_M

GHSA-q537-qhj4-wcjx PYSEC-2026-167

Authentication Bypass Opencti Opencti Platform

7.2

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Jun 08, 2026 - 10:12 vuln.today

Analysis Generated

Jun 08, 2026 - 10:12 vuln.today

Patch available

May 26, 2026 - 19:02 EUVD

DescriptionCVE.org

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 6.9.7, an organization admin can escalate their privileges by adding a user from a different organization with higher privileges, to their own organization. This is due to incorrect ACL on userEdit relationAdd. This vulnerability is fixed in 6.9.7.

AnalysisAI

Privilege escalation in OpenCTI prior to 6.9.7 allows an organization admin to gain elevated platform-wide privileges by adding a higher-privileged user from a different organization into their own organization, exploiting incorrect ACL enforcement on the userEdit relationAdd GraphQL mutation. The flaw yields full platform access and exposure of sensitive intelligence data; no public exploit identified at time of analysis and EPSS is very low (0.04%, 11th percentile), but the vendor-confirmed GHSA advisory and trivial attack complexity make this a meaningful tenancy-isolation issue for multi-organization deployments.

Technical ContextAI

OpenCTI is an open source Cyber Threat Intelligence (CTI) platform that exposes a GraphQL API for managing users, organizations, and threat knowledge, with role-based access control intended to enforce separation between tenants. The vulnerability is rooted in CWE-284 (Improper Access Control): the userEdit relationAdd resolver - used to attach a user to an organization via a GraphQL relationship mutation - fails to verify that the calling organization admin has authority over the target user. The affected CPE is cpe:2.3:a:opencti-platform:opencti:*:*:*:*:*:*:*:* across all versions below 6.9.7, including the Python client package pycti tracked separately in PyPA's advisory database (PYSEC-2026-167). Because OpenCTI ingests proprietary IOCs, attribution, and incident data, an ACL gap on a relationship mutation collapses the multi-tenant boundary the platform is designed to enforce.

RemediationAI

Vendor-released patch: upgrade OpenCTI to 6.9.7 or later, and update the pycti client package to 6.9.7 as referenced in GHSA-q537-qhj4-wcjx (https://github.com/OpenCTI-Platform/opencti/security/advisories/GHSA-q537-qhj4-wcjx). Until the upgrade can be scheduled, restrict the organization-admin role to fully trusted operators only and audit recent userEdit/relationAdd GraphQL operations and organization membership changes for unexpected cross-organization additions of privileged users; the trade-off is operational overhead and loss of self-service org administration. In multi-tenant or community-shared deployments, consider temporarily consolidating user administration under platform administrators rather than per-organization admins until the patch is applied, accepting reduced delegation in exchange for closing the privilege-escalation path.