DEV Community

kozhevniko
kozhevniko

Posted on

OpenCTI Readers Can Open Cases: Inside CVE-2026-76822's Missing Capability Check

#cybersecurity #infosec #security

OpenCTI Readers Can Open Cases: Inside CVE-2026-76822's Missing Capability Check

Vulnerability overview

CVE-2026-76822 is an authorization defect in OpenCTI, the open-source threat intelligence platform maintained by Filigran. GitHub security advisory GHSA-w45v-76pj-xggm scores it 4.3, moderate, with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, and credits SalusCyber1 for the report. CERT-Bund records the same issue in advisory WID-SEC-2026-3563 at risk level "hoch" for the affected product family.

How the authorization gap works

The vendor description leaves no room for interpretation. The GraphQL mutations caseIncidentAdd, caseRfiAdd and caseRftAdd are protected by @auth and by nothing else. @auth is an authentication decorator: it confirms that a caller holds a session, and it stops there. Authorization in OpenCTI is expressed through capability requirements such as the settings and knowledge permissions, which is what normally keeps a read-only account from writing to the workspace. Those three mutations were published without the second gate.

Exploitation conditions

Nothing about the flaw requires special positioning. The attack vector is network, complexity is low, privileges required are low, and user interaction is none. One valid account is enough, and a reader account qualifies. No payload, no memory corruption and no chain with a second bug is involved; the caller simply sends a write mutation the UI would normally hide from their role.

Impact

The recorded impact is integrity only: confidentiality and availability are marked unaffected. In practice that means an unauthorized principal can add case objects to the platform, including incidents, requests for information and requests for takedown. Those objects feed the same workflows analysts use for triage, so a polluted case queue wastes investigative time and can distort reporting until someone reconciles authorship against expected roles.

Affected products and scope

OpenCTI installations below version 7.260701.0 are vulnerable, and 7.260701.0 is the patched release. CERT-Bund lists Linux and UNIX as the operating systems for the affected deployment context. The defect sits in the GraphQL API, so container, package or source deployments are equally affected once the endpoint is reachable.

Exposure context

A ZoomEye search for app="OpenCTI" returned 1046 internet-facing instances at the time of writing, and a separate query for vul.cve="CVE-2026-76822" returned 0. Neither number identifies vulnerable hosts. The first is a product fingerprint count that includes patched systems and internal-only deployments are absent from it entirely; the second is expected to be zero because a missing capability check cannot be observed from outside the API.

Remediation and mitigations

Upgrade to OpenCTI 7.260701.0 or later. Until that happens, treat every authenticated session as a potential case creator: reduce reader accounts, review capability assignments, and watch case creation for authors whose role does not include that action. The same advisory batch also carries GHSA-2872-rg44-j9gx, a critical sandbox escape in the safeEjs notifier template path that is fixed in 7.260811.0, so planning a single maintenance window for both releases avoids a second outage later.

References

Top comments (0)