CVE-2026-44730

Executive Summary

CVE-2026-44730 is a privilege escalation vulnerability in OpenCTI, an open-source platform for managing cyber threat intelligence. The flaw allows an organization admin to escalate their privileges by adding a user from a different organization who holds higher privileges to their own organization. This is due to incorrect Access Control List (ACL) enforcement on the userEdit relationAdd operation. The vulnerability has a CVSS score of 7.2 (High) and affects versions prior to 6.9.7. No public exploit code or proof-of-concept is currently available, and the EPSS score is 0.0%, indicating a low probability of exploitation in the wild at this time. The patch is available in version 6.9.7.

CVSS Breakdown & Threat Level

• CVSS Score: 7.2 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: High (Organization Admin)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

The threat level is High due to the potential for a privileged user to gain full control over the platform by escalating to a higher-privileged role (e.g., Global Admin). The attack requires an organization admin account, but once exploited, the attacker can access all data and configurations across organizations.

Deep Dive & Mechanics

The vulnerability resides in the ACL enforcement for the userEdit mutation, specifically the relationAdd operation. In OpenCTI, users belong to organizations, and each organization has admins who can manage users within their own organization. However, due to a missing or incorrect ACL check, an organization admin can add a user from a different organization who holds higher privileges (e.g., a Global Admin) to their own organization. This effectively transfers the higher-privileged user into the attacker's organization, granting the attacker the ability to inherit or leverage those privileges.

The root cause is that the userEdit mutation does not properly validate that the user being added belongs to the same organization as the admin performing the action. The ACL check only verifies that the admin has permission to edit users in their own organization, but it does not restrict the source organization of the user being added.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-6.9.7): The vulnerable code likely resides in the GraphQL resolver for userEdit. The relationAdd operation would check if the requesting user is an admin of their organization but would not verify that the target user belongs to the same organization.

// Vulnerable pseudo-code
async function userEditRelationAdd(parent, args, context) {
  const { user } = context;
  const { input } = args;
  // Only checks if user is admin of their own org
  if (!user.isAdmin()) {
    throw new Error('Not authorized');
  }
  // Missing check: ensure target user belongs to same org
  const targetUser = await getUser(input.userId);
  // No validation of targetUser.organization vs user.organization
  return addRelation(user.id, targetUser.id);
}

Patched Code (6.9.7+): The patched version adds an additional check to ensure the target user belongs to the same organization as the requesting admin.

// Patched pseudo-code
async function userEditRelationAdd(parent, args, context) {
  const { user } = context;
  const { input } = args;
  if (!user.isAdmin()) {
    throw new Error('Not authorized');
  }
  const targetUser = await getUser(input.userId);
  // New check: ensure target user belongs to same organization
  if (targetUser.organization !== user.organization) {
    throw new Error('Cannot add users from other organizations');
  }
  return addRelation(user.id, targetUser.id);
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to an OpenCTI instance (version < 6.9.7)
• An organization admin account (e.g., orgadmin@example.com)
• Knowledge of a user ID from another organization with higher privileges (e.g., a Global Admin)

Exploitation Steps:

1. Log in as the organization admin.
2. Identify the user ID of a Global Admin from another organization (e.g., via API enumeration or social engineering).
3. Send a GraphQL mutation to add that user to your organization:

   mutation {
     userEditRelationAdd(
       input: {
         userId: "global-admin-user-id",
         relation: "memberOf",
         toId: "your-organization-id"
       }
     ) {
       id
     }
   }
   

4. Once the user is added, you can now impersonate or leverage their privileges within your organization.

Note: No public exploit code is available. This is a theoretical exploitation based on the vulnerability description.

Blue Team

Detection:

• Monitor GraphQL API logs for userEditRelationAdd mutations where the toId (organization) differs from the requesting user's organization.
• Alert on any addition of users from external organizations to an organization by an admin.

Hunting:

• Query the database for users who have been added to an organization they were not originally part of.
• Review audit logs for unusual relationAdd operations on user entities.

Mitigation:

• Immediately upgrade to OpenCTI 6.9.7 or later.
• If upgrade is not possible, restrict API access to trusted IPs and enforce strict monitoring.

Indicators of Compromise (IOCs)

• Log Entries: GraphQL mutation userEditRelationAdd with toId different from the requesting user's organization.
• Database Anomalies: Users with memberOf relations pointing to organizations they were not originally assigned to.
• Network Traffic: Unusual API calls to /graphql with payloads containing userEditRelationAdd.

Detection Engineering

YARA Rule

rule detect_opencti_privilege_escalation {
  meta:
    description = "Detects GraphQL mutations attempting to add users from other organizations"
    author = "Valters IT"
    date = "2025-04-10"
    reference = "CVE-2026-44730"
  strings:
    $mutation = "userEditRelationAdd"
    $relation = "memberOf"
  condition:
    all of them
}

Sigma Rule

title: OpenCTI Privilege Escalation via userEditRelationAdd
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to add users from other organizations in OpenCTI
author: Valters IT
date: 2025-04-10
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-44730
logsource:
  category: application
  product: opencti
detection:
  selection:
    event: "userEditRelationAdd"
    relation: "memberOf"
  condition: selection
falsepositives:
  - Legitimate admin actions within the same organization
level: high

Suricata Rule

alert http any any -> any any (
  msg:"CVE-2026-44730 - OpenCTI Privilege Escalation Attempt";
  content:"userEditRelationAdd"; http_client_body;
  content:"memberOf"; http_client_body;
  classtype:attempted-admin;
  sid:1000001;
  rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade OpenCTI to version 6.9.7 or later.
2. Review all organization admin accounts and ensure they are legitimate.
3. Audit user-organization relationships for any anomalies.

Long-term Measures:

• Implement additional monitoring for GraphQL mutations that modify user-organization relationships.
• Enforce the principle of least privilege for all admin accounts.
• Regularly review and update access control policies.

Workarounds (if upgrade is not possible):

• Restrict network access to the OpenCTI API to trusted IPs only.
• Implement a Web Application Firewall (WAF) rule to block userEditRelationAdd mutations with cross-organization toId values.

Valters IT
Securing Your Digital Frontier