Incorrect ACL on the userEdit relationAdd endpoint in OpenCTI allows an organization administrator to add a user belonging to a higher‑privilege organization into their own organization, effectively elevating the administrator’s privileges across the platform. The flaw is a classic authorization bypass (CWE‑284) and can result in unauthorized access to data and configuration that the higher‑privilege user normally controls.

The vulnerability affects the OpenCTI‑Platform OpenCTI application for all releases before version 6.9.7. Any deployment of the open‑source platform that has not applied the 6.9.7 update is susceptible.

The CVSS score of 7.2 indicates a high‑severity privilege escalation risk. The EPSS score is < 1% (0.00036), indicating a very low exploitation probability, but the flaw involves an internal interface that an organization admin can use, so the likelihood of exploitation is still significant for compromised or misconfigured accounts. The vulnerability is not currently listed in CISA KEV, but administrators should treat it as a serious risk due to the potential for cross‑organization privilege abuse.