CVE-2022-30290 Missing authorization in n/a
Attackers can arbitrarily change their registered email and API key in OpenCTI, bypassing interface restrictions to potentially take over accounts.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-30290?
CVE-2022-30290 is a high-severity missing authorization vulnerability in n/a, published on 5 Jul 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In OpenCTI through 5.2.4, a broken access control vulnerability has been identified in the profile endpoint. An attacker can abuse the identified vulnerability in order to arbitrarily change their registered e-mail address as well as their API key, even though such action is not possible through the interface, legitimately.
Which versions are affected by CVE-2022-30290?
1 open source package ship an affected version, including pycti. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
pycti PyPI | All versions | 5.3.0 |
Products include Citeum Opencti.
How do I fix CVE-2022-30290?
Upgrade pycti to 5.3.0 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2022-30290 being exploited?
There is no known exploitation of CVE-2022-30290 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2026-27960 OpenCTI privilege escalation and unauthenticated access via default admin account
- CVE-2026-39980 OpenCTI affected by RCE via notifier template
- CVE-2025-24977 OpenCTI has remote code execution and sensitive secrets exposed through web hook
- CVE-2024-26139 OpenCTI Authenticated Privilege Escalation
- CVE-2024-45404 OpenCTI's lack of Rate Limit lead to OTP brute forcing
Sources
Also known as GHSA-3pmr-x3j2-ff44, PYSEC-2022-43186.