OpenCTI-Platform's opencti before version 6.9.7 contains an improper access control vulnerability (CWE-284) that allows an organization administrator to escalate privileges. Specifically, the flaw arises because the system does not correctly enforce access control on the userEdit relationAdd functionality, enabling an admin to add a user from another organization with higher privileges into their own organization, effectively elevating their access rights. This issue is addressed in version 6.9.7.

Successful exploitation allows an organization admin to escalate their privileges by incorporating a higher-privileged user from a different organization into their own. This can lead to unauthorized access and control within the platform, impacting confidentiality, integrity, and availability of the system as indicated by the CVSS vector (C:H/I:H/A:H). There are no known exploits in the wild at this time.

Upgrade OpenCTI-Platform opencti to version 6.9.7 or later, where this improper access control vulnerability is fixed. Patch status is not explicitly stated as 'official-fix' in the vendor advisory, but the description confirms the issue is resolved in 6.9.7. No other mitigation steps are indicated.