CVE-2026-35210 Details

A vulnerability allowing authorization bypass has been identified in OpenCTI versions prior to 7.260326.0. This issue allows any authenticated user with KNOWLEDGE_KNUPDATE permission to bypass Confidence Level validation and Object Marking restrictions. The vulnerability is exploited by injecting the synchronized-upsert: true HTTP header, which enables users to downgrade confidence levels, remove security markings such as TLP:RED, manipulate relationships between threat intelligence entities, and affect various STIX object types, including Indicators, Threat Actors, Malware, and Reports.

Users are advised to update to OpenCTI version 7.260326.0 or later, where this vulnerability has been patched.