CVE Intelligence
Analysis AI-assisted

CVE-2026-27960: OpenCTI privilege escalation and unauthenticated API access via default admin account

A privilege escalation flaw in OpenCTI lets unauthenticated attackers query the API as any existing user, including the default admin account. The record reports a critical CVSS 9.8 score and lists affected versions from 6.6.0 up to before 6.9.13. The fix is stated in version 6.9.13, and disabling the default admin account is given as a workaround.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

CVE-2026-27960 affects OpenCTI, an open source platform for managing cyber threat intelligence knowledge and observables. According to the record, a privilege escalation flaw allows an unauthenticated attacker to query the API as any existing user, including the default admin account. The record classifies the weakness as CWE-287 (Improper Authentication).

Impact

  • The record describes unauthenticated API access acting as existing users, including the default admin account.
  • The CVSS 3.1 vector marks confidentiality, integrity and availability impact as high, with a base score of 9.8 reported by GitHub.
  • The SSVC data in the record marks technical impact as total and automatable as yes.

Affected products and versions

  • OpenCTI-Platform Opencti: listed as from 6.6.0 up to before 6.9.13.
  • Citeum Opencti: listed as from 6.9.0 up to before 6.9.13.
  • The description states that versions 6.6.0 through 6.9.12 are affected and that the issue is fixed in 6.9.13.

Exploitation status

This CVE is not listed in the CISA KEV catalog in the record, and the SSVC exploitation field is set to none. No confirmed exploitation appears in the sources consulted.

Remediation and mitigation

  • Plan an upgrade to version 6.9.13, the fixed version stated in the record.
  • As a workaround described in the record, disable the default admin account using the APP__ADMIN__EXTERNALLY_MANAGED configuration option.
  • Review the vendor advisory for full details: GitHub Security Advisory GHSA-6vvv-vmfr-xhrx.

Detection guidance

  • Review authentication and API access logs for activity attributed to the default admin account or to other users that cannot be matched to legitimate sessions.
  • Check for access to OpenCTI instances from unexpected network sources, especially instances reachable from outside the internal network.
  • Verify the deployed version and the admin account configuration on every instance, including instances not managed centrally.

Limitations of the available information

  • The record does not describe the technical conditions of the flaw in detail, and this analysis does not attempt to reproduce them.
  • The fixes entry in the record is typed as mitigation, and no separate patch commit is listed.
  • The record lists a CVSS score of 9.8 from two providers, and EPSS values are included without further context.
  • The only reference in the record is the vendor advisory.

Frequently asked questions

What is CVE-2026-27960?

It is a privilege escalation vulnerability in OpenCTI that, according to the record, lets an unauthenticated attacker query the API as any existing user, including the default admin account.

Which OpenCTI versions are affected?

The record lists OpenCTI-Platform Opencti from 6.6.0 up to before 6.9.13, and Citeum Opencti from 6.9.0 up to before 6.9.13.

Is there a fix or workaround?

The record states the issue is fixed in 6.9.13. It also describes disabling the default admin account with the APP__ADMIN__EXTERNALLY_MANAGED configuration as a workaround.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.