OpenCTI CVE-2025-61781

Exploitation requires (1) an authenticated session on the target OpenCTI instance - the description frames the actor as a 'user'/'requester', consistent with an IDOR rather than true pre-auth access - and (2) knowledge of an active UUID of another user's workspace object (dashboard or investigation case). The flaw is present in default configurations of all OpenCTI versions prior to 6.8.1, so no special feature toggle or non-default setting is needed. Limiting factors: no victim user interaction is required, but the attacker must hold a valid account/token and must supply a valid target UUID, which bounds this to authenticated insiders or attackers with a foothold on the platform; single-user deployments face little practical risk.

Raw severity signals and real-world exploitation signals diverge sharply here. The NVD CVSS 3.1 vector rates this 9.1 Critical (AV:N/AC:L/PR:N/UI:N/C:N/I:H/A:H), driven by the high integrity and availability impact of unauthorized workspace deletion. However, the exploitation-probability signals are modest: EPSS is only 0.13% (32nd percentile), the CVE is NOT on the CISA KEV list, and no public exploit code has been identified at time of analysis. There is also an internal conflict: the published vector claims PR:N (unauthenticated), yet the description repeatedly frames the actor as a platform 'user'/'requester' supplying another user's UUID - a classic broken-object-level-authorization (IDOR) pattern that almost always presupposes an authenticated session. This suggests the true privilege requirement is PR:L, which would lower the real-world score. Net assessment: this is a genuine broken-access-control defect that is trivial to trigger once a valid session and a target UUID are held, but it is a destructive-insider / authenticated-abuse risk rather than a mass, remote, unauthenticated threat. It warrants prompt patching for any multi-user or multi-tenant OpenCTI deployment, but the absence of KEV/POC and the low EPSS mean it is not a drop-everything internet-facing emergency on the order of its 9.1 label.

An authenticated OpenCTI user (or an attacker who has compromised any low-privilege account) enumerates or obtains the UUID of a dashboard or investigation workspace belonging to another user, then issues the WorkspacePopoverDeletionMutation GraphQL call against it. Because the mutation never verifies resource ownership, the server executes the deletion and the victim's entire workspace is destroyed. No public exploit code has been identified at time of analysis, but the attack is a straightforward single GraphQL request requiring no special tooling.