EUVD-2026-12578Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
4DescriptionGitHub Advisory
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.9.1, the GraphQL mutations "IndividualDeletionDeleteMutation" is intended to allow users to delete individual entity objects respectively. However, it was observed that this mutation can be misused to delete unrelated and sensitive objects such as analyses reports etc. This behavior stems from the lack of validation in the API to ensure that the targeted object is contextually related to the mutation being executed. Version 6.9.1 fixes the issue.
AnalysisAI
OpenCTI versions prior to 6.9.1 contain an authorization bypass vulnerability in the GraphQL mutation 'IndividualDeletionDeleteMutation' that allows authenticated users to delete arbitrary unrelated objects such as analysis reports, not just the intended individual entities. The vulnerability stems from insufficient input validation in the API layer, enabling a user with basic mutation privileges to escalate their impact beyond intended scope. With a CVSS score of 6.5 and authenticated access requirement, this represents a moderate but actionable availability risk for organizations managing threat intelligence with OpenCTI.
Technical ContextAI
OpenCTI is an open-source threat intelligence management platform that exposes a GraphQL API for programmatic interaction with its knowledge base. The vulnerability resides in the GraphQL mutation layer, specifically the 'IndividualDeletionDeleteMutation' resolver, which fails to validate that the target object ID supplied by the user belongs to an 'Individual' entity type before processing the deletion request. This violates CWE-285 (Improper Authorization), a class of vulnerabilities where access control checks are either missing or inadequate. The affected product is identified via CPE cpe:2.3:a:opencti-platform:opencti:*:*:*:*:*:*:*:* for all versions before 6.9.1. The GraphQL endpoint likely accepts object IDs as polymorphic inputs without type-checking, allowing an attacker to reference sensitive objects (reports, analyses) by their ID and achieve deletion outside the intended mutation contract.
RemediationAI
Upgrade OpenCTI to version 6.9.1 or later as released by the OpenCTI Platform project (see https://github.com/OpenCTI-Platform/opencti/security/advisories/GHSA-mhmx-j75v-2m6x for the official advisory). The patch implements proper type validation in the GraphQL mutation resolver to ensure only 'Individual' entity objects can be deleted via the 'IndividualDeletionDeleteMutation' endpoint. Until patching is feasible, apply network segmentation to restrict GraphQL API access to trusted administrative users only, implement rate limiting on mutation endpoints to reduce opportunistic deletion, and enforce strong authentication (MFA) on user accounts with mutation privileges. Regular audits of audit logs for unexpected deletion operations on non-Individual entities are recommended as a compensating control. Test the upgrade in a non-production environment before deploying to production to ensure schema compatibility.
OpenCTI 3.3.1 is vulnerable to a directory traversal attack via the static/css endpoint. An unauthenticated attacker can
Unauthenticated attackers can escalate privileges in OpenCTI 6.6.0-6.9.12 by impersonating any user account, including t
OpenCTI 3.3.1 is vulnerable to a reflected cross-site scripting (XSS) attack via the /graphql endpoint. An attacker can
OpenCTI is an open cyber threat intelligence (CTI) platform. Rated critical severity (CVSS 9.1), this vulnerability is r
Server-Side Template Injection in OpenCTI notifier templates allows privileged administrators with 'Manage customization
OpenCTI is an open-source cyber threat intelligence platform. Rated high severity (CVSS 8.1), this vulnerability is remo
OpenCTI is an open source platform allowing organizations to manage their cyber threat intelligence knowledge and observ
In OpenCTI through 5.2.4, a broken access control vulnerability has been identified in the profile endpoint. Rated high
Privilege escalation in OpenCTI prior to 6.9.7 allows an organization admin to gain elevated platform-wide privileges by
Authorization bypass in OpenCTI prior to version 7.260326.0 lets any authenticated user holding the KNOWLEDGE_KNUPDATE p
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.
Elasticsearch Painless script injection via OpenCTI's GraphQL API allows any authenticated user holding the KNOWLEDGE ca
Same weakness CWE-285 – Improper Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today