EUVD-2026-31908
GHSA-q537-qhj4-wcjx
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionGitHub Advisory
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 6.9.7, an organization admin can escalate their privileges by adding a user from a different organization with higher privileges, to their own organization. This is due to incorrect ACL on userEdit relationAdd. This vulnerability is fixed in 6.9.7.
AnalysisAI
Privilege escalation in OpenCTI prior to 6.9.7 allows an organization admin to gain elevated platform-wide privileges by adding a higher-privileged user from a different organization into their own organization, exploiting incorrect ACL enforcement on the userEdit relationAdd GraphQL mutation. The flaw yields full platform access and exposure of sensitive intelligence data; no public exploit identified at time of analysis and EPSS is very low (0.04%, 11th percentile), but the vendor-confirmed GHSA advisory and trivial attack complexity make this a meaningful tenancy-isolation issue for multi-organization deployments.
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a pre-existing organization-administrator account on an OpenCTI instance running a version below 6.9.7, network reachability to the OpenCTI GraphQL API endpoint, and knowledge of (or ability to enumerate) a target user from another organization who holds higher privileges than the attacker. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H yields 7.2 (High): network-reachable, low complexity, no user interaction, but requires high privileges (an existing organization admin account), with high impact across confidentiality, integrity, and availability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A user holding organization-admin rights in a multi-tenant OpenCTI instance identifies a higher-privileged account (for example, a platform administrator or a member of another organization with broad capabilities) and issues a crafted GraphQL userEdit relationAdd mutation to attach that account to their own organization. Because the ACL check on the relationship resolver is missing, the operation succeeds and the attacker inherits or leverages the elevated user's context to read sensitive threat intelligence, modify data, or take over the platform. … |
| Remediation | Vendor-released patch: upgrade OpenCTI to 6.9.7 or later, and update the pycti client package to 6.9.7 as referenced in GHSA-q537-qhj4-wcjx (https://github.com/OpenCTI-Platform/opencti/security/advisories/GHSA-q537-qhj4-wcjx). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify all OpenCTI instances, document current versions, and determine if multi-organization mode is enabled. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today