Opencti CVE-2026-21886

The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) indicates network-accessible exploitation requiring only low privileges (authenticated user account), no user interaction, and high impact on availability with no confidentiality or integrity impact. The CVSS base score of 6.5 places this in the 'medium' category, which may understate real-world risk depending on deployment context: in a shared threat intelligence platform with many users, a low-privileged analyst could permanently destroy critical analysis reports, causing operational disruption. The vulnerability is not listed as actively exploited in known exploited vulnerabilities (KEV) databases based on available data, nor is a public proof-of-concept confirmed, which moderates immediate exploitation likelihood. However, the attack complexity is low and requires only authentication (common in enterprise deployments), making this exploitable opportunistically by insider threats or compromised low-privilege accounts. Real-world risk is elevated in multi-tenant or shared-user environments where tenant isolation is critical; isolation in single-user or highly restricted deployments reduces priority. Patch availability (version 6.9.1) is confirmed, making remediation straightforward.

An authenticated analyst user with basic permissions in a shared OpenCTI instance discovers via API documentation or reverse engineering that the GraphQL 'IndividualDeletionDeleteMutation' endpoint accepts generic object IDs without type validation. The attacker crafts a mutation query specifying the ID of a sensitive analysis report instead of an Individual entity. The mutation executes successfully due to missing authorization checks, resulting in permanent deletion of the report and disruption of ongoing threat investigation workflows. No special network positioning is required (AV:N) and the operation is deterministic, making this a practical attack requiring only GraphQL API knowledge and a valid user account.