PT-2026-56601 · Opencti Platform · Opencti

Published 2026-07-08 · Updated 2026-07-08 · CVE-2026-35210

Mitre

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260326.0, an authorization bypass vulnerability in OpenCTI allows any authenticated user with KNOWLEDGE KNUPDATE permission to bypass Confidence Level validation and Object Marking restrictions by injecting the synchronized-upsert: true HTTP header, enabling attackers to downgrade confidence levels, remove security markings such as TLP:RED, manipulate relationships, and affect STIX object types including Indicators, ThreatActors, Malware, and Reports. This issue is fixed in version 7.260326.0.

Fix

IDOR

Incorrect Authorization

Weakness Enumeration

CWE-639

CWE-863

Related Identifiers

CVE-2026-35210

Affected Products

Opencti

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-35210 · Security Note
• https://github.com/OpenCTI-Platform/opencti/commit/134531ddf5ecf741006b7f0870b7c36711b96540 · Note
• https://github.com/OpenCTI-Platform/opencti/security/advisories/GHSA-36fr-4m54-94mj · Note
• https://github.com/OpenCTI-Platform/opencti/releases/tag/7.260326.0 · Note
• https://github.com/OpenCTI-Platform/opencti/pull/14243 · Note