| Affected_by_vulnerabilities |
| 0 |
| url |
VCID-5tbh-31ep-6qey |
| vulnerability_id |
VCID-5tbh-31ep-6qey |
| summary |
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.8.1, the GraphQL mutation "WorkspacePopoverDeletionMutation" allows users to delete workspace-related objects such as dashboards and investigation cases. However, the mutation lacks proper authorization checks to verify ownership of the targeted resources.
An attacker can exploit this by supplying an active UUID of another user. Since the API does not validate whether the requester owns the resource, the mutation executes successfully, resulting in unauthorized deletion of the entire workspace. Version 6.8.1 fixes the issue. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2025-61781, GHSA-pr6m-q4g7-342c, PYSEC-2026-116
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-5tbh-31ep-6qey |
|
| 1 |
| url |
VCID-8gcn-2c8s-ekay |
| vulnerability_id |
VCID-8gcn-2c8s-ekay |
| summary |
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.5.2, any user with the capability manage customizations can edit webhook that will execute javascript code. This can be abused to cause a denial of service attack by prototype pollution, making the node js server running the OpenCTI frontend become unavailable. Version 6.5.2 fixes the issue. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2025-26621, PYSEC-2025-180
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-8gcn-2c8s-ekay |
|
| 2 |
| url |
VCID-96y9-h6nw-kbfd |
| vulnerability_id |
VCID-96y9-h6nw-kbfd |
| summary |
OpenCTI is an open source platform allowing organizations to manage their cyber threat intelligence knowledge and observables. Due to lack of certain security controls on the profile edit functionality, an authenticated attacker with low privileges can gain administrative privileges on the web application. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2024-26139, GHSA-qx4j-f4f2-vjw9, PYSEC-2024-296
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-96y9-h6nw-kbfd |
|
| 3 |
| url |
VCID-dndj-mx1m-hyg7 |
| vulnerability_id |
VCID-dndj-mx1m-hyg7 |
| summary |
A stored Cross-site Scripting (XSS) vulnerability was identified in the Data Import functionality of OpenCTI through 5.2.4. An attacker can abuse the vulnerability to upload a malicious file that will then be executed by a victim when they open the file location. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2022-30289, PYSEC-2022-43185
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-dndj-mx1m-hyg7 |
|
| 4 |
| url |
VCID-ere8-2ws9-jyac |
| vulnerability_id |
VCID-ere8-2ws9-jyac |
| summary |
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 6.8.16, the OpenCTI platform’s data ingestion feature accepts user-supplied URLs without validation and uses the Axios HTTP client with its default configuration (allowAbsoluteUrls: true). This allows attackers to craft requests to arbitrary endpoints, including internal services, because Axios will accept and process absolute URLs. This results in a semi-blind SSRF, as responses may not be fully visible but can still impact internal systems. This vulnerability is fixed in 6.8.16. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-21887, GHSA-ffm6-vvph-g5f5, PYSEC-2026-118
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-ere8-2ws9-jyac |
|
| 5 |
| url |
VCID-ftqe-k9h3-e7ds |
| vulnerability_id |
VCID-ftqe-k9h3-e7ds |
| summary |
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.6.6, an IDOR vulnerability in the GrapQL `NotificationLineNotificationMarkReadMutation` and `NotificationLineNotificationDeleteMutation` mutations of OpenCTI allows an authenticated user to change the read status of a notification or delete a notification of another user in case he has knowledge of the UUID of the notification. When changing the read status of a notification, the user also receives the content of the notification they changed the read status of. Authenticated Users in OpenCTI can read, modify and delete notification of other users if they know the UUID of the notification. Version 6.6.6 fixes the issue. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2025-46732, GHSA-535g-qp2c-h7vp, PYSEC-2025-181
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-ftqe-k9h3-e7ds |
|
| 6 |
| url |
VCID-m7xr-bwh3-wkg1 |
| vulnerability_id |
VCID-m7xr-bwh3-wkg1 |
| summary |
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.9.1, the GraphQL mutations "IndividualDeletionDeleteMutation" is intended to allow users to delete individual entity objects respectively. However, it was observed that this mutation can be misused to delete unrelated and sensitive objects such as analyses reports etc. This behavior stems from the lack of validation in the API to ensure that the targeted object is contextually related to the mutation being executed. Version 6.9.1 fixes the issue. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-21886, GHSA-mhmx-j75v-2m6x, PYSEC-2026-117
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-m7xr-bwh3-wkg1 |
|
| 7 |
| url |
VCID-qk3d-28zr-vqfr |
| vulnerability_id |
VCID-qk3d-28zr-vqfr |
| summary |
OpenCTI is an open-source cyber threat intelligence platform. In versions below 6.2.18, because the function to limit the rate of OTP does not exist, an attacker with valid credentials or a malicious user who commits internal fraud can break through the two-factor authentication and hijack the account. This is because the otpLogin mutation does not implement One Time Password rate limiting. As of time of publication, it is unknown whether a patch is available. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2024-45404, GHSA-hg56-r6hh-56j7, PYSEC-2024-297
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-qk3d-28zr-vqfr |
|
| 8 |
| url |
VCID-tp2b-yzdw-5yfr |
| vulnerability_id |
VCID-tp2b-yzdw-5yfr |
| summary |
OpenCTI is an open-source cyber threat intelligence platform. Before 6.3.0, general users can access information that can only be accessed by users with access privileges to admin and support information (SETTINGS_SUPPORT). This is due to inadequate access control for support information (http://<opencti_domain>/storage/get/support/UUID/UUID.zip), and that the UUID is available to general users using an attached query (logs query). This vulnerability is fixed in 6.3.0. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2024-45805, GHSA-42mm-c8x3-g5q6, PYSEC-2024-298
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-tp2b-yzdw-5yfr |
|
| 9 |
| url |
VCID-vb19-z3p4-9yc9 |
| vulnerability_id |
VCID-vb19-z3p4-9yc9 |
| summary |
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 6.9.7, an organization admin can escalate their privileges by adding a user from a different organization with higher privileges, to their own organization. This is due to incorrect ACL on userEdit relationAdd. This vulnerability is fixed in 6.9.7. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-44730, GHSA-q537-qhj4-wcjx, PYSEC-2026-167
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-vb19-z3p4-9yc9 |
|
| 10 |
| url |
VCID-w9bh-gssc-57dh |
| vulnerability_id |
VCID-w9bh-gssc-57dh |
| summary |
In OpenCTI through 5.2.4, a broken access control vulnerability has been identified in the profile endpoint. An attacker can abuse the identified vulnerability in order to arbitrarily change their registered e-mail address as well as their API key, even though such action is not possible through the interface, legitimately. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2022-30290, PYSEC-2022-43186
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-w9bh-gssc-57dh |
|
|
|---|