CVE-2022-30290

CVE-2022-30290 affects OpenCTI up to version 5.2.4, where a broken access control issue in the profile endpoint lets an attacker change their registered email and API key despite these actions not being possible through the legitimate interface. Affected component: profile endpoint in OpenCTI. Ro...

CVE-2024-37155

CVE-2024-37155 (OpenCTI) affects OpenCTI prior to 6.1.9. The issue arises from a bypass of the GraphQL introspection validation: removing whitespace, carriage returns, and line feeds (\r\n) defeats the regex, enabling unauthenticated full Introspection queries and potential data exposure. This ca...

CVE-2024-26139

CVE-2024-26139 affects OpenCTI OpenCTI platform. The vulnerability arises from a lack of securityControls on the profile edit functionality, enabling an authenticated attacker with low privileges to escalate to administrative privileges in the web application. Public records (CNVD) cite OpenCTI v...

CVE-2025-24977

CVE-2025-24977 (OpenCTI) affects OpenCTI prior to version 6.4.11. The vulnerability arises because a user with the privilege to manage customizations can misuse web-hooks to execute commands on the underlying infrastructure and access internal server-side secrets, effectively allowing a root shel...

CVE-2024-45404

CVE-2024-45404 affects OpenCTI prior to 6.2.18. The root cause is the absence of rate limiting on the OTP mechanism, specifically the otpLogin mutation, enabling an attacker with valid credentials (or a malicious insider) to bypass two-factor authentication and hijack an account. Evidence from mu...

CVE-2025-24887

OpenCTI has a CVE-2025-24887 vulnerability affecting versions 6.4.8–6.4.9. The issue lets a user bypass the allow/deny lists to modify attributes meant to be immutable, including toggling the external flag, changing a user’s own token, and editing non-allow-listed attributes such as otp_qr and ot...

CVE-2024-45805

Affected software: OpenCTI Open-Source Threat Intelligence Platform (prior to 6.3.0). Vulnerability / root cause: Inadequate access control allowed general users to access information intended for admin and support roles via the endpoint/storage/get/support/UUID/UUID.zip, exposing the UUID throug...

CVE-2026-44730

OpenCTI (open-source platform for threat intel) has a privilege-escalation vulnerability affecting the GraphQL API prior to version 6.9.7. An organization admin can elevate privileges by adding a user from a different organization with higher privileges to their own organization due to an incorre...

CVE-2022-30289

Technical details (exploit PoC, affected versions beyond 5.2.4, mitigations, or in-depth root cause) are not publicly provided in the connected documents. Monitor for updates.

CVE-2026-35212

OpenCTI vulnerability CVE-2026-35212: XSS in rendering of email-message observable body data due to insufficient sanitization in versions prior to 7.260227.0. The body content is rendered without proper sanitization, requiring user interaction and could be triggered by sharing STIX or ingesters, ...

CVE-2025-26621

OpenCTI vulnerability CVE-2025-26621: Prior to version 6.5.2, users with the capability to manage customizations can edit a webhook that executes JavaScript code. This can be abused to trigger a denial-of-service via prototype pollution, rendering the Node.js server running the OpenCTI frontend u...

CVE-2026-39980

OpenCTI prior to 6.9.5 has a vulnerability in safeEjs.ts where EJS templates are not properly sanitized, allowing users with Manage customization capability to run arbitrary JavaScript in the platform process context during notifier template execution. The issue is fixed in 6.9.5; CVSS 3.1 base s...

CVE-2025-61782

OpenCTI prior to version 6.8.3 contains an open redirect in the SAML callback endpoint (/auth/saml/callback). By manipulating the RelayState parameter, an attacker can trigger a 302 redirect to an arbitrary external URL, enabling phishing and credential theft. Remediation: upgrade to version 6.8....

CVE-2026-35210

Summary: OpenCTI prior to version 7.260326.0 contains an authorization bypass via the synchronized-upsert: true HTTP header, exploitable by any authenticated user with KNOWLEDGE_KNUPDATE permission. This allows bypassing Confidence Level validation and Object Marking restrictions, enabling attack...

CVE-2025-46732

OpenCTI prior to 6.6.6 is affected by an IDOR in GraphQL mutations NotificationLineNotificationMarkReadMutation and NotificationLineNotificationDeleteMutation. An authenticated user can read, modify, or delete another user’s notifications if they know the notification UUID; changing read status m...

CVE-2026-27960

OpenCTI suffers a privilege escalation in versions 6.6.0–6.9.12 that allows unauthenticated attackers to query the API as any existing user, including the default admin account. The issue has been fixed in version 6.9.13. As a temporary mitigation, the default admin can be disabled via APP__ADMIN...

CVE-2026-21887

OpenCTI platform (data ingestion feature) is vulnerable prior to 6.8.16 due to accepting user-supplied URLs without validation and using Axios with allowAbsoluteUrls: true, enabling semi-blind SSRF to internal endpoints. Impact reported as HIGH (CVSS 3.1: 7.7) with network attack vector and low p...

CVE-2026-35211

OpenCTI exposes a script filter operator in the GraphQL FilterOperator enum prior to version 7.260401.0. An authenticated user with the KNOWLEDGE capability can pass user-supplied Elasticsearch Painless script values directly into search queries without validation, enabling potentially expensive ...

CVE-2020-37041

CVE-2020-37041 is confirmed in OpenCTI 3.3.1 to have a directory traversal vulnerability via the /static/css endpoint. An unauthenticated attacker can read arbitrary filesystem files by crafting GET requests containing path traversal sequences (for example, /static/css//../../../../../../../../et...

CVE-2026-21886

OpenCTI CVE-2026-21886 describes a validation gap in the GraphQL mutation IndividualDeletionDeleteMutation that could let a user delete unrelated or sensitive objects (e.g., analyses, reports) due to lack of contextual checks. Affected software: OpenCTI prior to version 6.9.1. Root cause: API mut...

CVE-2020-37044

CVE-2020-37044 affects OpenCTI 3.3.1, with a reflected XSS flaw in the /graphql endpoint. The vulnerability allows an attacker to inject arbitrary JavaScript by sending a crafted GET request with a malicious payload in the query string, resulting in script execution in the victim’s browser (examp...

CVE-2025-61781

OpenCTI prior to 6.8.1 is affected by an authorization flaw in the GraphQL mutation WorkspacePopoverDeletionMutation, which allows an authenticated user to delete workspace objects (dashboards, investigation cases) belonging to other users. The API does not verify ownership, enabling unauthorized...