Privilege escalation to platform admin in OpenCTI-Platform through broken access control in API

Finding

An organization admin can escalate their privileges by adding a user from a different organization with higher privileges, to their own organization.

Impact

Full platform access, access to sensitive or proprietary information.

Patches

Yes, users should upgrade to at least version 6.9.7 .

References

https://github.com/OpenCTI-Platform/opencti/security/advisories/GHSA-q537-qhj4-wcjx