An authenticated user possessing the KNOWLEDGE_KNUPDATE permission can set the synchronized-upsert: true HTTP header, which the OpenCTI application incorrectly accepts as a truestated keyword. By doing so, the user can bypass internal checks that enforce confidence level limits and Object Marking restrictions. This flaw of threat intelligence entities, strip critical security markings such as TLP:RED, alter relationships between STIX objects, and modify many core object types, including Indicators, ThreatActors, Malware and Reports. The integrity and confidentiality of the threat data are therefore compromised, potentially undermining downstream analytics and reporting.

OpenCTI Platform (OpenCTI) versions prior to 7.260326.0 are affected. The vulnerability is tied to the platform's handling of HTTP headers in API contexts, so any instance of the platform deployed before the mentioned release is vulnerable.

The base CVSS score of 7.1 indicates a high severity. The EPSS score of < 1% suggests a low probability of exploitation, although the vulnerability can be triggered by an authenticated user with a specific role and therefore represents a significant risk. The vulnerability is not listed in the CISA KEV catalog, which reduces the likelihood of immediate exploitation but still poses a severe threat to organizations relying on OpenCTI for accurate threat intelligence. A malicious actor can remotely craft a request with the injection header to manipulate data without further authentication steps.