CVE-2026-44730
High
Description
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 6.9.7, an organization admin can escalate their privileges by adding a user from a different organization with higher privileges, to their own organization. This is due to incorrect ACL on userEdit relationAdd. This vulnerability is fixed in 6.9.7.
SeverityHigh
CVSS7.2
Exploit probability—
ProductCiteum Opencti
PublishedMay 26, 2026
First seenMay 26, 2026
Weakness typeCWE-284Improper access control
How to fix
Update
- citeum opencti6.9.7 or later
- pycti6.9.7 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| citeum opencti | v < 6.9.7 | 6.9.7 |
| pyctiPyPI | v < 6.9.7 | 6.9.7 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.