CVE-2026-35210 is an authorization bypass vulnerability in the OpenCTI platform (opencti) affecting versions before 7.260326.0. Authenticated users with the KNOWLEDGE_KNUPDATE permission can inject the 'synchronized-upsert: true' HTTP header to bypass confidence level validation and object marking restrictions. This enables unauthorized modification of confidence levels, removal of security markings like TLP:RED, and manipulation of relationships and STIX object types such as Indicators, ThreatActors, Malware, and Reports. The vulnerability is addressed in version 7.260326.0.

An attacker with authenticated access and KNOWLEDGE_KNUPDATE permission can bypass critical authorization controls, allowing them to downgrade confidence levels and remove security markings that are intended to protect sensitive threat intelligence data. This can lead to manipulation of threat intelligence objects, potentially undermining the integrity and trustworthiness of the data used for cybersecurity operations. The impact includes confidentiality loss (partial), integrity compromise (high), and no availability impact.

Upgrade OpenCTI to version 7.260326.0 or later, where this authorization bypass vulnerability is fixed. No other official remediation or temporary fixes are indicated. Until the upgrade, restrict KNOWLEDGE_KNUPDATE permissions to trusted users only.