OpenCTI CVE-2026-76822: Case Creation, Permissions, and Provenance

iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more

An authenticated OpenCTI user with reader permissions could create case objects because three case-creation GraphQL mutations lacked a capability requirement. OpenCTI’s advisory says versions earlier than 7.260701.0 are affected and 7.260701.0 or later are patched. For operators, the fix is to upgrade and consider whether case authorship during the affected period matches the organization’s permission policy.

What CVE-2026-76822 allowed

OpenCTI-Platform’s GitHub Security Advisory GHSA-w45v-76pj-xggm, published September 23, 2026, describes an authorization vulnerability in case creation. It says a user with reader permissions could create case objects through these GraphQL mutations:

#	Preview	Product	Price
1		J. J. Keller Cargo Securement Handbook for Drivers, Spiral Bound	$12.59	Buy on Amazon

• caseIncidentAdd
• caseRfiAdd
• caseRftAdd

The advisory says the mutations were protected by @auth but had no capability requirement. Authentication establishes that a caller has a valid session; authorization determines whether that caller may perform a particular action. Here, requiring a session did not ensure that the user had the capability to create a case. The issue concerned these named case-creation operations, not every OpenCTI mutation. Read the OpenCTI advisory.

Which OpenCTI versions are affected?

According to the advisory, OpenCTI versions below 7.260701.0 are affected; version 7.260701.0 and later are patched. Check the version running in your deployment and follow the project’s current release guidance when upgrading. Do not treat a version number found in a deployment plan or package list as confirmation that the running instance has been updated.

#1 Best Overall

J. J. Keller Cargo Securement Handbook for Drivers, Spiral Bound

• Handbook helps cargo trailer drivers stay safe and in compliance with U.S. and Canadian load securement requirements.
• Load securement book combines cargo securement regulations with practical hands-on guidance and illustrated best practices in one convenient source.
• Helps drivers determine the best approach to securing cargo and cargo trailer accessories they're transporting, based on government recommendations.
• Provides need-to-know guidelines on proper use of blocks, ropes, chains, bars, and more for flatbeds, dry vans, reefers, and other widely used types of trailers. Also provides critical information about general load securement requirements, commodity-specific requirements, cargo securement regulations, tiedown quick reference, frequently asked questions, and much more.
• 7" x 5" English spiral bound handbook with 190+ pages. Copyright 2017.

$12.59

Buy on Amazon

How severe is the vulnerability?

OpenCTI rates CVE-2026-76822 Moderate, with a CVSS 3.1 base score of 4.3. Its vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N: the issue is network reachable, low complexity, requires low privileges, and requires no user interaction. The vector records low integrity impact and no confidentiality or availability impact. These are the project advisory’s severity assessment and vector, not evidence that any particular deployment was exploited.

What case-queue integrity means for operators

Case creation by an account that should only have reader permissions raises a provenance question: do the recorded author and the user’s expected authority align with the organization’s policy? An unauthorized case could enter an analyst workflow even if its contents are not malicious. The vulnerability establishes the ability to create cases regardless of role; it does not establish that existing cases were altered, that reader accounts were abused, or that cases in a particular installation are untrustworthy.

After upgrading, organizations may prudently review cases created during the period their deployment was on an affected version. This is an operational precaution, not a forensic procedure mandated by OpenCTI. Secondary commentary recommends reviewing case authorship and role assignment, but it does not prove that every affected installation contains unauthorized cases. See the secondary operational commentary.

How to conduct a proportionate review

1. Confirm the running version. Compare it with the advisory’s affected and patched ranges, then upgrade according to OpenCTI’s current release guidance if necessary.
2. Set the review window. Identify when the deployment ran an affected version. Use deployment and upgrade records to scope the period; the advisory does not establish a universal exposure window for every installation.
3. Review case authorship against policy. Examine cases created in the relevant period and compare their authors with the authority those accounts were expected to have. Prioritize cases that do not fit the organization’s normal permissions or workflow.
4. Use the records your deployment actually retains. Available sources do not establish which audit fields or retention periods are present in every OpenCTI installation, or specify a universal query to reconstruct a creator’s effective role. Consult the applicable installation documentation and logs; do not assume that an audit record captures historical roles unless you can verify it.
5. Handle anomalies as investigation leads. An unexpected author or case is a reason to investigate context, not proof by itself of malicious activity. Preserve relevant records and follow your organization’s incident-handling process.

What the advisory does not establish

• It does not report that a particular OpenCTI deployment was exploited or that every reader account was abused.
• It does not establish disclosure of data, service disruption, arbitrary code execution, or changes to existing case records.
• It does not provide population-level statistics for exploited or vulnerable installations.
• It does not specify the audit fields, retention, or queries available in a given deployment.

Those limits matter when interpreting the provenance risk: the defect makes unauthorized case creation possible, but determining whether it happened—and what records can establish—depends on the deployment’s own history and evidence.

Quick Recap

Bestseller No. 1

J. J. Keller Cargo Securement Handbook for Drivers, Spiral Bound

7" x 5" English spiral bound handbook with 190+ pages. Copyright 2017.

$12.59

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.