TI-2026-22303 Aliases CVE-2026-27960

OpenCTI privilege escalation and unauthenticated access via default admin account

MEDIUM 59CWE-287Published 2026-05-05 · Updated 2026-05-06

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-287.

Summary

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. In versions 6.6.0 through 6.9.12, there is a privilege escalation vulnerability that can be exploited by unauthenticated attackers to query the API as any existing user, including the default admin account. This issue has been fixed in version 6.9.13. As a workaround, the default admin can be disabled using the `APP__ADMIN__EXTERNALLY_MANAGED` configuration.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.07086 94th percentileScored 2026-11-07

Fix Fixed opencti (OpenCTI-Platform): 6.9.13

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
OpenCTI-Platform	opencti	6.6.0 to before 6.9.13	6.9.13	Patch available	CNA

opencti VendorOpenCTI-Platform Affected 6.6.0 to before 6.9.13 Fixed in 6.9.13 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:citeum:opencti::::::::	6.9.0 to before 6.9.13	Vulnerable	OpenCTI-Platform

cpe:2.3:a:citeum:opencti:*:*:*:*:*:*:*:* Versions 6.9.0 to before 6.9.13 Vulnerable ·OpenCTI-Platform

Remediation

Fix · CNA opencti (OpenCTI-Platform) Fixed in 6.9.13

Timeline

2026-10-02 Threatist record created from CVE-2026-27960
2026-10-16 EPSS moved to the 90th–95th percentile

References

Advisory 1

https://github.com/OpenCTI-Platform/opencti/security/advisories/GHSA-6vvv-vmfr-xhrx

TI-2024-24682 OpenCTI May Bypass Introspection Restriction CVSS 3.1HIGH 8.2
TI-2024-30453 OpenCTI's lack of Rate Limit lead to OTP brute forcing CVSS 3.1HIGH 8.1
TI-2020-19176 OpenCTI 3.3.1 - Directory Traversal CVSS 4.0HIGH 7.1
TI-2020-19179 OpenCTI 3.3.1 - Cross Site Scripting CVSS 4.0MEDIUM 5.1
TI-2024-30771 OpenCTI leaks support information due to inadequate access control CVSS 3.1MEDIUM 4.3
TI-2026-28835 OpenCTI affected by RCE via notifier template CVSS 3.1CRITICAL 9.1

See all 21 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences