CVE-2026-35210
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
In OpenCTI prior to version 7.260326.0, an authorization bypass vulnerability allows any authenticated user with KNOWLEDGE_KNUPDATE permission to bypass Confidence Level validation and Object Marking restrictions by injecting the synchronized-upsert: true HTTP header. This enables attackers to downgrade confidence levels, remove security markings like TLP:RED, manipulate relationships, and affect STIX object types including Indicators, ThreatActors, Malware, and Reports.
Risk Assessment
An attacker can unauthorizedly modify critical threat intelligence data such as indicators, threat actors, malware, or reports, leading to loss of data integrity and potentially causing incorrect risk assessments within the organization.
Recommendation
Immediately upgrade OpenCTI to version 7.260326.0 or later, which contains the fix for this vulnerability.
Other vulnerabilities in OpenCTI
See all- CVE-2025-61781High
OpenCTI before version 6.8.1 contains a vulnerability in the GraphQL mutation WorkspacePopoverDeletionMutation that allows deletion of workspace-related objects (e.g., dashboards, investigation cases) without proper authorization. An attacker can supply another user's active UUID and delete the entire workspace because the API does not validate ownership.
- CVE-2026-27960Critical
In OpenCTI, versions 6.6.0 through 6.9.12, there is a privilege escalation vulnerability that can be exploited by unauthenticated attackers to query the API as any existing user, including the default admin account.
- CVE-2026-35211Medium
OpenCTI GraphQL API exposes a script filter operator in its FilterOperator enum that allows authenticated users with KNOWLEDGE capability to pass unsanitized Elasticsearch Painless scripts into search queries. This can cause CPU resource exhaustion and denial of service for all users.
- CVE-2026-35212Medium
OpenCTI versions prior to 7.260227.0 are vulnerable to XSS in the rendering of email-message observable body data. The content of the body field isn't appropriately sanitized when being rendered. Requires user interaction but could be exploited by someone sharing STIX or any of the ingester.
- CVE-2026-44730High
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 6.9.7, an organization admin can escalate their privileges by adding a user from a different organization with higher privileges to their own organization. This is due to incorrect ACL on userEdit relationAdd. This vulnerability is fixed in 6.9.7.
Original NVD description (English source)
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260326.0, an authorization bypass vulnerability in OpenCTI allows any authenticated user with KNOWLEDGE_KNUPDATE permission to bypass Confidence Level validation and Object Marking restrictions by injecting the synchronized-upsert: true HTTP header, enabling attackers to downgrade confidence levels, remove security markings such as TLP:RED, manipulate relationships, and affect STIX object types including Indicators, ThreatActors, Malware, and Reports. This issue is fixed in version 7.260326.0.