7.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-44730

CVE-2026-44730: OpenCTI: Privilege escalation via graphQL API abusable by organization admins, due to incorrect ACL on userEdit relationAdd

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 6.9.7, an organization admin can escalate their privileges by adding a user from a different organization with higher privileges, to their own organization. This is due to incorrect ACL on userEdit relationAdd. This vulnerability is fixed in 6.9.7.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-44730

CVE-2026-44730:

7.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Total

Select your environment

→SSVCScheduled60 days

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
pycti	pip	>= 0, < 6.9.7	6.9.7

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a privilege escalation in OpenCTI's GraphQL API. The root cause is improper access control in several functions within opencti-platform/opencti-graphql/src/domain/user.js. An organization administrator could perform actions such as adding users to their organization, editing user fields, and adding relationships to users that were outside of their authorized access scope. This could be exploited to add a user with higher privileges from a different organization into the admin's own organization, thereby escalating privileges.

The patch introduces a new function, loadUserToUpdateWithAccessCheck, which consolidates and enforces the necessary access control checks. This function verifies that the user performing the action has the required capabilities or, if they are an organization admin, that the user being acted upon is within their administrated organizations. This new function is now used in assignOrganizationToUser, userEditField, userAddRelation, and other user management functions to prevent the unauthorized actions.

Vulnerable functions

assignOrganizationToUser

opencti-platform/opencti-graphql/src/domain/user.js

The function `assignOrganizationToUser` was vulnerable to privilege escalation because it did not properly check if the organization admin had the rights to access the user they were trying to add to their organization. An attacker could abuse this to add a user with higher privileges from another organization to their own, thereby escalating their privileges. The patch fixes this by using the `loadUserToUpdateWithAccessCheck` function which enforces proper access control.

userEditField

opencti-platform/opencti-graphql/src/domain/user.js

The function `userEditField` was vulnerable because it allowed an organization admin to edit users outside of their administrated organizations. This could be used to escalate privileges by modifying the details of a user with higher privileges. The patch fixes this by using the `loadUserToUpdateWithAccessCheck` function which enforces proper access control.

userAddRelation

opencti-platform/opencti-graphql/src/domain/user.js

The function `userAddRelation` was vulnerable as it allowed an organization admin to add relationships to users they should not have access to. This could be abused to, for example, add a user to a privileged group, leading to privilege escalation. The patch fixes this by using the `loadUserToUpdateWithAccessCheck` function which enforces proper access control.

userDelete

opencti-platform/opencti-graphql/src/domain/user.js

The function `userDelete` was vulnerable as it allowed an organization admin to delete users outside of their administrated organizations. The patch fixes this by using the `loadUserToUpdateWithAccessCheck` function which enforces proper access control.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.