CVE-2025-24887mediumCWE-284CWE-657

CVE-2025-24887: medium-severity vulnerability in OpenCTI-Platform opencti

OpenCTI bypass of protected attribute update

Published

Follow this CVE+ Monitor opencti+ Monitor pycti

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.3epss 0.3%
In short

OpenCTI versions 6.4.8 to 6.4.9 allow users to bypass security restrictions and modify attributes they shouldn't be able to change, such as marking accounts as external or changing their own authentication tokens. This can let attackers enumerate user accounts and gain unauthorized access.

Technical detail

The vulnerability exists in the allow/deny list validation mechanism that fails to properly enforce attribute protection, allowing authenticated users with low privileges to modify protected fields (external flag, token, otp_qr, otp_activated) via API requests. This enables user enumeration and potential privilege escalation through token manipulation.

Summary generated and translated by AI from the official description.
OpenCTI is an open-source cyber threat intelligence platform. In versions starting from 6.4.8 to before 6.4.10, the allow/deny lists can be bypassed, allowing a user to change attributes that are intended to be unmodifiable by the user. It is possible to toggle the `external` flag on/off and change the own token value for a user. It is also possible to edit attributes that are not in the allow list, such as `otp_qr` and `otp_activated`. If external users exist in the OpenCTI setup and the information about these users identities is sensitive, the above vulnerabilities can be used to enumerate existing user accounts as a standard low privileged user. This issue has been patched in version 6.4.10.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Affected products
OpenCTI-Platform · opencti
Related CVEs — OpenCTI-Platform opencti

In the same product, most dangerous first.

CVE-2026-27960CRITICALOpenCTI privilege escalation and unauthenticated access via default admin accountEPSS 7.1%CVE-2026-39980CRITICALOpenCTI affected by RCE via notifier templateEPSS 1.4%CVE-2025-24977CRITICALOpenCTI has remote code execution and sensitive secrets exposed through web hookEPSS 0.9%CVE-2024-45404HIGHOpenCTI's lack of Rate Limit lead to OTP brute forcingEPSS 0.6%CVE-2026-35211MEDIUMOpenCTI: Elasticsearch Painless Script Injection via GraphQL `script` filter operator allows authenticated user to exfiltrate data and cause DoSEPSS 0.5%CVE-2026-76821HIGHOpenCTI: User-Controlled ReDoS in JSON Ingestion MapperEPSS 0.5%