Free tools Windows power users keep installed
One-click scans. No signup required.
An authenticated OpenCTI user with reader permissions could create case objects because three case-creation GraphQL mutations lacked a capability requirement. The project says versions below 7.260701.0 are affected and 7.260701.0 or later are patched. That makes this both an authorization flaw and a practical case-provenance question: after upgrading, do case authors and their permissions match your organization’s policy?
What CVE-2026-76822 allowed
OpenCTI’s GitHub Security Advisory GHSA-w45v-76pj-xggm, published September 23, 2026, describes an authorization vulnerability in case creation. A user with reader permissions could create case objects. The affected GraphQL mutations are caseIncidentAdd, caseRfiAdd, and caseRftAdd.
As an Amazon Associate I earn from qualifying purchases.
The advisory says these operations were protected by @auth but lacked a capability requirement. In other words, authentication established that a caller had a valid session, but the mutations did not also require the permission intended for case creation. The issue concerns these named case-creation operations; it is not evidence that every OpenCTI mutation was affected.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Which OpenCTI versions are affected?
According to the project advisory, OpenCTI versions earlier than 7.260701.0 are affected, while 7.260701.0 and later are patched. Check the version actually running in your deployment, including each relevant environment, and follow OpenCTI’s current release guidance when upgrading. The version boundary is the project’s stated fix, not a substitute for confirming that your deployment is on a patched release.
How serious is the vulnerability?
OpenCTI rates CVE-2026-76822 Moderate, with a CVSS 3.1 base score of 4.3. Its vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. The vector describes a network-reachable attack of low complexity that requires low privileges and no user interaction; it assigns low integrity impact, with no confidentiality or availability impact.
This rating describes the vulnerability’s assessed technical impact. It does not show whether an individual organization was targeted, whether a reader account was used to create cases, or how many deployments were affected.
Rank #2
Why this is a case-provenance issue
Case queues inform analyst work and organizational decisions. If a reader-level account could create cases, the organization may want to check whether case authorship and the creator’s role align with its intended permissions. That is a prudent operational review prompted by the flaw, not a claim that every affected installation contains unauthorized or malicious cases.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsThe confirmed weakness was the ability to create cases regardless of role. The advisory does not say that the vulnerability changed existing case records, exposed confidential data, disrupted service, or enabled code execution. Nor do the available sources establish which audit fields or retention settings a particular deployment has. Treat any reconstruction of historical creation events as deployment-specific: use the records and documentation available in your own environment rather than assuming a particular audit report or query exists.
Quick Recap
Best Value
Rank #3
What operators should do
- Confirm the running version. Compare the deployed OpenCTI version with the project advisory’s affected range: below 7.260701.0 is affected; 7.260701.0 and later is patched.
- Upgrade if needed. If the deployment is on an affected version, move to a patched release using OpenCTI’s current release guidance.
- Review case authorship against policy. After patching, identify case records created during the period your deployment was exposed, where available, and assess whether each creator should have had case-creation authority. The secondary DEV Community commentary also recommends an authorship and role-assignment review; this is operational advice, not a forensic procedure required by the vendor.
- Escalate anomalies through your normal process. Investigate cases that do not match expected authorship or workflow, while distinguishing evidence of a permission mismatch from evidence of malicious intent.
What the finding does—and does not—establish
- Established by OpenCTI: authenticated users with reader permissions could create cases through the three named mutations; versions below 7.260701.0 are affected and 7.260701.0 or later are patched.
- Not established for a specific installation: whether anyone exploited the flaw, whether cases were created without organizational approval, or what historical role and audit information the deployment retained.
- Not demonstrated by this advisory: unauthenticated access, broad mutation authorization failure, confidentiality loss, service disruption, or modification of existing cases.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
