CVE-2026-35210 json
OpenCTI: Authorization Bypass via `synchronized-upsert` HTTP Header Injection
published 2026-07-08 4 mo ago modified 2026-10-25 14 d ago also GHSA-36fr-4m54-94mj , PYSEC-2026-3445 , EUVD-2026-42430
- cvss
- 7.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 29%
- public exploits
- 0
- none known
Summary
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260326.0, an authorization bypass vulnerability in OpenCTI allows any authenticated user with KNOWLEDGE_KNUPDATE permission to bypass Confidence Level validation and Object Marking restrictions by injecting the synchronized-upsert: true HTTP header, enabling attackers to downgrade confidence levels, remove security markings such as TLP:RED, manipulate relationships, and affect STIX object types including Indicators, ThreatActors, Malware, and Reports. This issue is fixed in version 7.260326.0.
Patch / fix
- pypi pycti 7.260326.0
- citeum opencti 7.260326.0
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 4 mo ago
Exploit prediction
0.35% chance of exploitation in the next 30 days, higher than 29% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N |
| OSV | 3.1 | 7.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | pycti | <7.260326.0 |
7.260326.0 |
Affected products
- OpenCTI-Platform opencti
Classification
References
-
github.com
/OpenCTI-Platform/opencti/pull/14243
issue-tracking, patch
-
github.com
/OpenCTI-Platform/opencti/commit/134531ddf5ecf741006b7f0870b7c36711b96540
patch
-
github.com
/OpenCTI-Platform/opencti/security/advisories/GHSA-36fr-4m54-94mj
vendor-advisory, advisory
-
github.com
/OpenCTI-Platform/opencti/releases/tag/7.260326.0
product, release-notes, advisory
Sources
- CVE List CVE-2026-35210
- NVD CVE-2026-35210
- OSV PYSEC-2026-3445
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.