In OpenCTI platform versions 6.6.0 through 6.9.12, an unauthenticated attacker can exploit a privilege escalation flaw to query the API as any existing user, including the default admin account. This vulnerability exposes the full set of authorizations granted to the default admin, allowing the attacker to read, modify, or delete threat intelligence data stored in the system. The weakness is a classic authentication bypass flaw (CWE-287).

OpenCTI-Platform opencti, specifically versions 6.6.0 to 6.9.12. The issue has been addressed in version 6.9.13 and later.

The CVSS score of 9.8 indicates a critical severity. No EPSS score is available, so the current exploitation probability is unknown. The vulnerability is not listed in CISA KEV. Attackers can exploit the flaw by sending unauthenticated API requests, implying a high likelihood of remote exploitation with no additional credentials required.