Unauthenticated privilege escalation affecting the OpenCTI (Open Cyber Threat Intelligence) platform
A critical elevation of privilege vulnerability affecting the OpenCTI platform would allow an unauthenticated malicious actor to gain administrative access rights to the system.
Description
Technical context and vulnerability details
OpenCTI is an open-source platform designed to help organizations manage their cyber threat knowledge and data. The platform is affected by a critical vulnerability labeled CVE-2026-27960 allowing an unauthenticated attacker to bypass access control mechanisms to elevate their privileges to the next level (Administrator). This vulnerability is classified as high with a severity score of 9.8 according to CVSS v3.1.
Potential Risks & Impact
Potential consequences upon exploitation
- Privilege escalation to an administrator account;
- Unauthorized access to intelligence databases;
- Complete compromise of system integrity;
Affected systems
Products, components and targeted versions
- OpenCTI versions between 6.6.0 and 6.9.12 inclusive;
Recommended Remediations & Actions
Immediate actions and recommended mitigations
- Update the OpenCTI platform to version 6.9.13;
- Review access logs to identify any signs of suspicious activity or unusual account creation;
Sources & External Links
Vendor security advisories and documentation
Advisory Specifications
CSIRT Emergency Response
Is your organization affected or do you suspect an incident? Our security experts are available to assist.
Report an incidentGet our alerts by email
Subscribe to receive our security alert bulletins and Iservices news straight to your inbox.