OpenCTI Privilege Escalation Vulnerability Allowing Unauthenticated API Access as Any User

A privilege escalation vulnerability has been identified in OpenCTI versions 6.6.0 prior to 6.9.13. This vulnerability allows unauthenticated attackers to query the API as any existing user, including the default admin account. The issue arises from improper access controls, enabling unauthorized users to gain elevated privileges through the API.

Impact

Exploitation of this vulnerability allows for unauthorized privilege escalation, enabling attackers to access the API with the rights of any existing user, including the default admin, which could lead to unauthorized actions or data access within the OpenCTI platform.

Remediation

Users can upgrade to OpenCTI version 6.9.13 or later to address this vulnerability. Additionally, the default admin account can be disabled using the APP__ADMIN__EXTERNALLY_MANAGED configuration.