CVE-2026-27960
published 2026-05-05CVE-2026-27960: OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. In versions 6.6.0 through 6.9.12, there is a privilege…
PriorityP187critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
4.68%
91.7th percentile
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. In versions 6.6.0 through 6.9.12, there is a privilege escalation vulnerability that can be exploited by unauthenticated attackers to query the API as any existing user, including the default admin account. This issue has been fixed in version 6.9.13. As a workaround, the default admin can be disabled using the `APP__ADMIN__EXTERNALLY_MANAGED` configuration.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| citeum | opencti | >= 6.9.0 < 6.9.13 | 6.9.13 |
| opencti-platform | opencti | — | — |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vulncheck9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
OpenCTI up to 6.9.12 improper authentication (GHSA-6vvv-vmfr-xhrx)
vuldb·2026-05-05·CVSS 9.8
CVE-2026-27960 [CRITICAL] OpenCTI up to 6.9.12 improper authentication (GHSA-6vvv-vmfr-xhrx)
A vulnerability labeled as critical has been found in OpenCTI up to 6.9.12. The affected element is an unknown function. The manipulation results in improper authentication.
This vulnerability is cataloged as CVE-2026-27960. The attack may be launched remotely. There is no exploit available.
The affected component should be upgraded.
VulnCheck
citeum opencti Improper Authentication
vulncheck·2026·CVSS 9.8
CVE-2026-27960 [CRITICAL] citeum opencti Improper Authentication
citeum opencti Improper Authentication
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. In versions 6.6.0 through 6.9.12, there is a privilege escalation vulnerability that can be exploited by unauthenticated attackers to query the API as any existing user, including the default admin account. This issue has been fixed in version 6.9.13. As a workaround, the default admin can be disabled using the `APP__ADMIN__EXTERNALLY_MANAGED` configuration.
Affected: citeum opencti
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://previdian.com/CVE-2026-27960
No detection rules found.
Nuclei
OpenCTI < 6.9.13 - Authentication Bypass via User Impersonation
nuclei·CVSS 9.8
CVE-2026-27960 [CRITICAL] OpenCTI < 6.9.13 - Authentication Bypass via User Impersonation
OpenCTI < 6.9.13 - Authentication Bypass via User Impersonation
OpenCTI < 6.9.13 allows authentication bypass by supplying a Bearer token set to the admin user's internal_id UUID instead of a valid JWT. The default admin internal_id (88ec0c6a-13ce-5e39-b486-354fe4a7084f) grants full admin access to the GraphQL API, effectively bypassing all authentication.
Template:
id: CVE-2026-27960
info:
name: OpenCTI < 6.9.13 - Authentication Bypass via User Impersonation
author: DhiyaneshDk
severity: critical
description: |
OpenCTI < 6.9.13 allows authentication bypass by supplying a Bearer token set to the admin user's internal_id UUID instead of a valid JWT. The default admin internal_id (88ec0c6a-13ce-5e39-b486-354fe4a7084f) grants full admin access to the GraphQL API, effectively bypassing all
No writeups or analysis indexed.
2026-05-05
Published
Exploited in the wild