PT-2026-56601 · Opencti Platform · Opencti

Publicado 2026-07-08 · Atualizado 2026-07-08 · CVE-2026-35210

Mitre

CVSS v3.1

7.1

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260326.0, an authorization bypass vulnerability in OpenCTI allows any authenticated user with KNOWLEDGE KNUPDATE permission to bypass Confidence Level validation and Object Marking restrictions by injecting the synchronized-upsert: true HTTP header, enabling attackers to downgrade confidence levels, remove security markings such as TLP:RED, manipulate relationships, and affect STIX object types including Indicators, ThreatActors, Malware, and Reports. This issue is fixed in version 7.260326.0.

Correção

IDOR

Incorrect Authorization

Enumeração de Fraquezas

CWE-639

CWE-863

Identificadores relacionados

CVE-2026-35210

Produtos afetados

Opencti

Referências · 5

• https://github.com/OpenCTI-Platform/opencti/commit/134531ddf5ecf741006b7f0870b7c36711b96540 · Nota
• https://github.com/OpenCTI-Platform/opencti/security/advisories/GHSA-36fr-4m54-94mj · Nota
• https://github.com/OpenCTI-Platform/opencti/releases/tag/7.260326.0 · Nota
• https://github.com/OpenCTI-Platform/opencti/pull/14243 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-35210 · Nota de Segurança