Vulnerability · Published May 26, 2026 · Assigned by GitHub_M

CVE-2026-44730OpenCTI: Privilege escalation via graphQL API abusable by organization admins, due to incorrect ACL on userEdit relationAdd

High 7.2

In plain English

A high-severity improper access control in opencti from OpenCTI-Platform. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.2High

Exploit odds (30 days)0.3%top 75.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 6.9.7, an organization admin can escalate their privileges by adding a user from a different organization with higher privileges, to their own organization. This is due to incorrect ACL on userEdit relationAdd. This vulnerability is fixed in 6.9.7.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	pycti	6.9.7	GHSA-q537-qhj4-wcjx
PyPI	pycti	6.9.7	PYSEC-2026-167

Affected products (as reported)

Vendor	Product	Versions
OpenCTI-Platform	opencti	< 6.9.7

Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/OpenCTI-Platform/opencti/security/advisories/GHSA-q537-qhj4-wcjx x_refsource_CONFIRM