CVE-2026-35210 is an authorization bypass vulnerability in the OpenCTI platform before version 7.260326.0. It allows any authenticated user with the KNOWLEDGE_KNUPDATE permission to bypass confidence level validation and object marking restrictions by injecting the 'synchronized-upsert: true' HTTP header. This enables attackers to downgrade confidence levels, remove security markings like TLP:RED, and manipulate relationships and STIX object types such as Indicators, ThreatActors, Malware, and Reports. The vulnerability is addressed in OpenCTI version 7.260326.0.

The vulnerability allows attackers with limited permissions to bypass critical security controls, including confidence level validation and object marking restrictions. This can lead to the manipulation of threat intelligence data, potentially reducing the reliability and trustworthiness of indicators and reports by downgrading confidence levels and removing security markings. Such manipulation could affect decision-making processes relying on this intelligence.

Upgrade OpenCTI to version 7.260326.0 or later, where this vulnerability is fixed. Since the vendor advisory confirms the fix in this version, applying this official update is the recommended remediation. No other temporary mitigations are specified.