OpenCTI Readers Can Open Cases: Inside CVE-2026-76822's Missing Capability Check
OpenCTI Readers Can Open Cases: Inside CVE-2026-76822's Missing Capability Check Vulnerability overview CVE-2026-76822 is an authorization defect in OpenCTI, the open-source threat intelligence platform maintained by Filigran. GitHub security advisory GHSA-w45v-76pj-xggm scores it 4.3, moderate, with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, and credits SalusCyber1 for the report.…
OpenCTI, an open-source threat intelligence platform, has a vulnerability (CVE-2026-76822) that allows unauthorized users to create case objects. This security issue, rated as moderate, stems from missing capability checks in three GraphQL mutations: caseIncidentAdd, caseRfiAdd, and caseRftAdd. These mutations, which are intended to be protected by @auth (authentication decorator), lack the necessary authorization gate, enabling attackers to add various case objects to the platform.
The vulnerability is easily exploitable, requiring only a single valid account and lacks complexity. Affected OpenCTI installations are those with versions below 7.260701.0, spanning Linux and UNIX operating systems. Upgrading to the latest version is the recommended solution, and the advisory also includes another critical security patch (GHSA-2872-rg44-j9gx) that should be addressed in the same maintenance window.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
