CVE-2026-27960 is a critical improper authentication vulnerability (CWE-287) in OpenCTI-Platform's opencti product affecting versions 6.6.0 up to but not including 6.9.13. It permits unauthenticated attackers to escalate privileges by querying the API as any user, including the default administrator. This vulnerability has a CVSS 3.1 base score of 9.8, reflecting its network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. The vulnerability was publicly disclosed on 2026-05-05 and is fixed in version 6.9.13. A workaround involves disabling the default admin account through configuration.

Successful exploitation allows unauthenticated attackers to impersonate any user, including the default admin, leading to full compromise of confidentiality, integrity, and availability of the OpenCTI instance. This can result in unauthorized access to sensitive threat intelligence data and administrative functions.

Upgrade OpenCTI-Platform to version 6.9.13 or later, where this vulnerability is fixed. Until upgrading, disable the default admin account by setting the APP__ADMIN__EXTERNALLY_MANAGED configuration option. Patch status is not explicitly stated as 'official-fix' in the vendor advisory, but the fix is included in version 6.9.13 as per the description. No cloud service remediation applies as this is self-hosted software.