CVE-2024-45805 OpenCTI leaks support information due to inadequate access control

What is CVE-2024-45805?

CVE-2024-45805 is a medium-severity missing authorization vulnerability in OpenCTI-Platform opencti, published on 26 Dec 2024. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

OpenCTI is an open-source cyber threat intelligence platform. Before 6.3.0, general users can access information that can only be accessed by users with access privileges to admin and support information (SETTINGS_SUPPORT). This is due to inadequate access control for support information (http://<opencti_domain>/storage/get/support/UUID/UUID.zip), and that the UUID is available to general users using an attached query (logs query). This vulnerability is fixed in 6.3.0.

Weakness: CWE-285, CWE-200

Which versions are affected by CVE-2024-45805?

1 open source package ship an affected version, including pycti. It affects 1 product.

Products include Citeum Opencti.

How do I fix CVE-2024-45805?

Upgrade pycti to 6.3.0 or later.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2024-45805 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-45805 exists.

Other vulnerabilities in OpenCTI-Platform opencti

• CVE-2026-27960 OpenCTI privilege escalation and unauthenticated access via default admin account Critical 9.8
• CVE-2026-39980 OpenCTI affected by RCE via notifier template Critical 9.1
• CVE-2025-24977 OpenCTI has remote code execution and sensitive secrets exposed through web hook Critical 9.1
• CVE-2024-26139 OpenCTI Authenticated Privilege Escalation High 8.3
• CVE-2024-45404 OpenCTI's lack of Rate Limit lead to OTP brute forcing High 8.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-42mm-c8x3-g5q6, PYSEC-2024-298.