CVE-2026-35210High· 7.1▾ TwilightOpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260326.0, an authorization bypass vulnerability in OpenCTI allows any authenticated user with KNOWLEDGE_KNUPDATE permission t…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 39.1 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 13.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.3%
0.3% → 0.4%
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260326.0, an authorization bypass vulnerability in OpenCTI allows any authenticated user with KNOWLEDGE_KNUPDATE permission to bypass Confidence Level validation and Object Marking restrictions by injecting the synchronized-upsert: true HTTP header, enabling attackers to downgrade confidence levels, remove security markings such as TLP:RED, manipulate relationships, and affect STIX object types including Indicators, ThreatActors, Malware, and Reports. This issue is fixed in version 7.260326.0.
opencti < 7.260326.0Upgrade past the affected range:
opencti 7.260326.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-35211Medium· 6.5OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables
CVE-2026-76820High· 7.7OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables
CVE-2026-76821High· 7.1OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables
CVE-2026-52743Medium· 4.3GoCD is a continuous deliver server
CVE-2026-14199High· 7.1Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (sync_ttl greater than zero) are affected
CVE-2026-15630Critical· 9.9CVE-2026-15630