CVE-2024-26139

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

OpenCTI is an open source platform allowing organizations to manage their cyber threat intelligence knowledge and observables. Due to lack of certain security controls on the profile edit functionality, an authenticated attacker with low privileges can gain administrative privileges on the web application.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-284 CWE-657

Affected software

No affected versions have been published.

Timeline

Published: May 23, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-26148.8Memory safety bugs present in Firefox 123, Firefox ESR 115.8, and Thunderbird 115.8. Some of these bugs showed evidence of memory corruption CVE-2024-261406.1com.yetanalytics/lrs is the Yet Analytics Core LRS Library. Prior to version 1.2.17 of the LRS library and version 0.7.5 of SQL LRS, a malic CVE-2024-261417.5Rack is a modular Ruby web server interface. Carefully crafted Range headers can cause a server to respond with an unexpectedly large respon CVE-2024-261427.5Rails is a web-application framework. Starting in version 7.1.0, there is a possible ReDoS vulnerability in the Accept header parsing routin CVE-2024-261436.1Rails is a web-application framework. There is a possible XSS vulnerability when using the translation helpers in Action Controller. Applica CVE-2024-261445.3Rails is a web-application framework. Starting with version 5.2.0, there is a possible sensitive session information leak in Active Storage.CVE-2024-261454.3Discourse Calendar adds the ability to create a dynamic calendar in the first post of a topic on Discourse. Uninvited users are able to gain CVE-2024-261467.5Rack is a modular Ruby web server interface. Carefully crafted headers can cause header parsing in Rack to take longer than expected resulti CVE-2024-261477.5Helm is a package manager for Charts for Kubernetes. Versions prior to 3.14.2 contain an uninitialized variable vulnerability when Helm pars CVE-2024-261486.1Querybook is a user interface for querying big data. Prior to version 3.31.1, there is a vulnerability in Querybook's rich text editor that CVE-2024-261495.3Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. If an excessively large value is specified as the starting ind CVE-2024-26159.8Memory safety bugs present in Firefox 123. Some of these bugs showed evidence of memory corruption and we presume that with enough effort so