CVE-2026-35210

Name of the Vulnerable Software and Affected Versions OpenCTI versions prior to 7.260326.0

Description An authorization bypass allows authenticated users with KNOWLEDGE KNUPDATE permission to circumvent Confidence Level validation and Object Marking restrictions. This is achieved by injecting the synchronized-upsert: true HTTP header. Attackers can use this method to downgrade confidence levels, remove security markings like TLP:RED, manipulate relationships, and modify STIX object types, including Indicators, ThreatActors, Malware, and Reports.

Recommendations Update to version 7.260326.0.