CVE-2026-44730: Citeum OpenCTI Privilege Escalation Flaw

CVE-2026-44730 Overview

CVE-2026-44730 is a privilege escalation vulnerability in OpenCTI, an open source platform for managing cyber threat intelligence knowledge and observables. The flaw exists in versions prior to 6.9.7 and stems from an incorrect Access Control List (ACL) check on the userEdit relationAdd operation. An organization administrator can escalate privileges by adding a higher-privileged user from a different organization into their own organization. The vendor addressed the issue in version 6.9.7. The weakness is tracked under CWE-284 (Improper Access Control).

Critical Impact
An authenticated organization admin can gain elevated privileges by attaching a foreign higher-privileged user to their own organization, breaking cross-organization isolation in OpenCTI.

Affected Products

OpenCTI versions prior to 6.9.7
Citeum OpenCTI platform deployments
Self-hosted OpenCTI instances with multi-organization configurations

Discovery Timeline

2026-05-26 - CVE-2026-44730 published to the National Vulnerability Database
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-44730

Vulnerability Analysis

The vulnerability is a horizontal-to-vertical privilege escalation in OpenCTI's user management subsystem. OpenCTI supports multi-tenant deployments where organization administrators manage members within their own organization scope. The userEdit relationAdd mutation, used to attach users to organizations, does not enforce a sufficient ACL check on the target user. An organization admin can therefore reference a user belonging to another organization and bind that user to their own organization. When the targeted user holds higher platform privileges, the admin inherits indirect control over that account's organizational context, breaking the tenancy boundary that OpenCTI relies on for least-privilege enforcement.

Root Cause

The root cause is missing or incorrect authorization logic in the userEdit relationAdd resolver. The handler validates that the caller is an organization admin but does not verify that the user being added is already a member of an organization the caller is authorized to administer. This is a classic [CWE-284] Improper Access Control flaw at the GraphQL mutation layer.

Attack Vector

Exploitation requires network access to the OpenCTI GraphQL API and valid credentials for an organization administrator account. The attacker issues a userEdit relationAdd mutation referencing the internal identifier of a higher-privileged user from another organization. The platform accepts the relation and grants the targeted user membership in the attacker-controlled organization, enabling abuse of inherited capabilities. No user interaction is required, and the attack can be executed through standard API tooling. Technical specifics are described in the OpenCTI GitHub Security Advisory GHSA-q537-qhj4-wcjx.

Detection Methods for CVE-2026-44730

Indicators of Compromise

Unexpected userEdit GraphQL mutations issued by organization-admin accounts referencing user identifiers outside their own organization.
New organization-membership relations linking high-privilege users (platform admins, connector accounts) to lower-trust organizations.
Audit log entries showing rapid sequences of relationAdd operations against the user object type.

Detection Strategies

Review OpenCTI audit logs for userEdit relationAdd operations and correlate the acting user's organization with the target user's prior organization.
Alert when an organization admin modifies relations on users that were not previously members of any organization they administer.
Baseline normal admin behavior and flag deviations such as cross-organization user manipulation.

Monitoring Recommendations

Forward OpenCTI application logs and GraphQL access logs to a centralized SIEM for long-term retention and correlation.
Monitor for privilege changes on accounts that hold platform-level or connector roles.
Track the version banner of running OpenCTI instances and alert on any instance reporting a version below 6.9.7.

How to Mitigate CVE-2026-44730

Immediate Actions Required

Upgrade all OpenCTI deployments to version 6.9.7 or later without delay.
Audit existing organization memberships and remove any unexpected cross-organization assignments created before the upgrade.
Rotate API tokens and session credentials for any user account that may have been improperly added to an unauthorized organization.

Patch Information

The vendor fixed the incorrect ACL on userEdit relationAdd in OpenCTI 6.9.7. Patch details and remediation guidance are published in the OpenCTI GitHub Security Advisory GHSA-q537-qhj4-wcjx. Operators running container images should pull the updated tag and redeploy. Operators using Helm or compose deployments should pin to the patched release and restart the platform and worker services.

Workarounds

Restrict the organization-admin role to a minimal set of trusted operators until the upgrade is complete.
Place the OpenCTI GraphQL endpoint behind a reverse proxy that enforces strict authentication and rate limiting.
Temporarily disable multi-organization features if they are not required by the deployment.

bash

# Verify the running OpenCTI version and upgrade to the patched release
curl -s https://<opencti-host>/graphql \
  -H "Authorization: Bearer <token>" \
  -d '{"query":"{ about { version } }"}'

# Example docker-compose pin to the fixed version
# image: opencti/platform:6.9.7
docker compose pull && docker compose up -d