OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. In versions 6.6.0 through 6.9.12, there is a privilege esca…

OpenCTI, an open source cyber threat intelligence platform, contains a privilege escalation vulnerability in versions 6.6.0 through 6.9.12. The vulnerability allows unauthenticated attackers to query the API as any existing user, including the default admin account. This represents a critical security flaw that could lead to complete system compromise. The issue has been patched in version 6.9.13. A workaround is available by disabling the default admin using the APP__ADMIN__EXTERNALLY_MANAGED configuration setting.