# CVE-2026-44730: OpenCTI privilege escalation in userEdit relationAdd

Source: https://junglewise.ai/threats/cve-2026-44730-opencti-privilege-escalation-in-useredit-relationadd  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-26. Updated: 2026-05-28  
License: CC BY 4.0 with a link back

CVE-2026-44730 · Severity: high · CVSS 7.2 · Published 2026-05-26

OpenCTI is an open-source platform used by organizations to manage and share cyber threat intelligence. A security flaw allowed administrators of a specific organization within the platform to grant themselves higher permissions by improperly adding users from other organizations to their own. This could lead to unauthorized access to sensitive threat data and full control over the platform's operations.

Technologies: [pycti (PyPI)](https://junglewise.ai/threats/technologies/pycti). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-44730 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44730 being exploited in the wild.

**How severe is CVE-2026-44730?** High severity, with a CVSS score of 7.2, published 26 May 2026.

**Which products and versions are affected?** pycti (PyPI) >= 0, < 6.9.7, ECOSYSTEM:introduced=0,fixed=6.9.7.

**Is there a fix for CVE-2026-44730?** Yes. pycti (PyPI): upgrade to 6.9.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-44730 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-44730?** Check whether you run pycti (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- pycti (PyPI): upgrade to 6.9.7 or later

  ```sh
  pip install "pycti>=6.9.7"
  ```


## Technical details

A privilege escalation vulnerability exists in OpenCTI's GraphQL API due to improper access control (CWE-284) on the 'userEdit' and 'relationAdd' functions. An attacker with organization administrator privileges can exploit this by adding a user from a different organization who possesses higher platform-wide privileges into their own organization. This action effectively grants the attacker the elevated permissions of the added user. The vulnerability is reachable over the network and requires high privileges to execute. It has been addressed in version 6.9.7.

## Affected products

- Filigran OpenCTI < 6.9.7
- Filigran pycti < 6.9.7

## Identifiers

- CVE-2026-44730
- GHSA-q537-qhj4-wcjx
- PYSEC-2026-167

## Timeline

- 2026-05-05: disclosed: Reported by Wachizungu
- 2026-05-26: advisory: NVD published CVE-2026-44730
- 2026-05-28: advisory: GitHub Advisory published

## References

- [https://api.github.com/users/Wachizungu](https://api.github.com/users/Wachizungu)
- [https://github.com/Wachizungu](https://github.com/Wachizungu)
- [https://api.github.com/users/Wachizungu/gists%7B/gist_id%7D](https://api.github.com/users/Wachizungu/gists%7B/gist_id%7D)
- [https://api.github.com/users/Wachizungu/repos](https://api.github.com/users/Wachizungu/repos)
- [https://avatars.githubusercontent.com/u/9868873?v=4](https://avatars.githubusercontent.com/u/9868873?v=4)
- [https://api.github.com/users/Wachizungu/events%7B/privacy%7D](https://api.github.com/users/Wachizungu/events%7B/privacy%7D)

## Related threats

- [Filigran OpenCTI Code Injection in GraphQL API](https://junglewise.ai/threats/cve-2026-35211-filigran-opencti-code-injection-in-graphql-api)
- [Filigran OpenCTI authorization bypass via synchronized-upsert header](https://junglewise.ai/threats/cve-2026-35210-filigran-opencti-authorization-bypass-via-synchronized-upsert)
- [OpenCTI SSRF in Data Ingestion Feature](https://junglewise.ai/threats/cve-2026-21887-opencti-ssrf-in-data-ingestion-feature)
- [OpenCTI GraphQL introspection restriction bypass](https://junglewise.ai/threats/cve-2024-37155-opencti-graphql-introspection-restriction-bypass)
- [OpenCTI XSS in email-message observable body rendering](https://junglewise.ai/threats/cve-2026-35212-opencti-xss-in-email-message-observable-body-rendering)