GitHub Advisoryadvisory · PyPI

GHSA-q537-qhj4-wcjx OpenCTI: Privilege escalation via graphQL API is abusable by organization admins, due to incorrect ACL on userEdit relationAdd

HIGH Published 2026-05-28 Modified 2026-05-28 Official page ↗
Aliases
CVE-2026-44730
Ecosystem
PyPI
Packages
pycti
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-284
Reviewed
2026-05-28

Affected packages

• PyPI pycti: < 6.9.7 → fixed in 6.9.7

Description

Summary An organization admin can escalate their privileges by adding a user from a different organization with higher privileges, to their own organization. Impact Full platform access, access to sensitive or proprietary information.

Related

Alias · CVE (1)

  • CVE-2026-44730 OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. vulnerability

Weakness · CWE (1)

  • CWE-284 Improper Access Control weakness

References