| Affected_by_vulnerabilities |
| 0 |
| url |
VCID-5tbh-31ep-6qey |
| vulnerability_id |
VCID-5tbh-31ep-6qey |
| summary |
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.8.1, the GraphQL mutation "WorkspacePopoverDeletionMutation" allows users to delete workspace-related objects such as dashboards and investigation cases. However, the mutation lacks proper authorization checks to verify ownership of the targeted resources.
An attacker can exploit this by supplying an active UUID of another user. Since the API does not validate whether the requester owns the resource, the mutation executes successfully, resulting in unauthorized deletion of the entire workspace. Version 6.8.1 fixes the issue. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2025-61781, GHSA-pr6m-q4g7-342c, PYSEC-2026-116
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-5tbh-31ep-6qey |
|
| 1 |
| url |
VCID-8gcn-2c8s-ekay |
| vulnerability_id |
VCID-8gcn-2c8s-ekay |
| summary |
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.5.2, any user with the capability manage customizations can edit webhook that will execute javascript code. This can be abused to cause a denial of service attack by prototype pollution, making the node js server running the OpenCTI frontend become unavailable. Version 6.5.2 fixes the issue. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2025-26621, PYSEC-2025-180
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-8gcn-2c8s-ekay |
|
| 2 |
| url |
VCID-ere8-2ws9-jyac |
| vulnerability_id |
VCID-ere8-2ws9-jyac |
| summary |
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 6.8.16, the OpenCTI platform’s data ingestion feature accepts user-supplied URLs without validation and uses the Axios HTTP client with its default configuration (allowAbsoluteUrls: true). This allows attackers to craft requests to arbitrary endpoints, including internal services, because Axios will accept and process absolute URLs. This results in a semi-blind SSRF, as responses may not be fully visible but can still impact internal systems. This vulnerability is fixed in 6.8.16. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-21887, GHSA-ffm6-vvph-g5f5, PYSEC-2026-118
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-ere8-2ws9-jyac |
|
| 3 |
| url |
VCID-ftqe-k9h3-e7ds |
| vulnerability_id |
VCID-ftqe-k9h3-e7ds |
| summary |
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.6.6, an IDOR vulnerability in the GrapQL `NotificationLineNotificationMarkReadMutation` and `NotificationLineNotificationDeleteMutation` mutations of OpenCTI allows an authenticated user to change the read status of a notification or delete a notification of another user in case he has knowledge of the UUID of the notification. When changing the read status of a notification, the user also receives the content of the notification they changed the read status of. Authenticated Users in OpenCTI can read, modify and delete notification of other users if they know the UUID of the notification. Version 6.6.6 fixes the issue. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2025-46732, GHSA-535g-qp2c-h7vp, PYSEC-2025-181
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-ftqe-k9h3-e7ds |
|
| 4 |
| url |
VCID-m7xr-bwh3-wkg1 |
| vulnerability_id |
VCID-m7xr-bwh3-wkg1 |
| summary |
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.9.1, the GraphQL mutations "IndividualDeletionDeleteMutation" is intended to allow users to delete individual entity objects respectively. However, it was observed that this mutation can be misused to delete unrelated and sensitive objects such as analyses reports etc. This behavior stems from the lack of validation in the API to ensure that the targeted object is contextually related to the mutation being executed. Version 6.9.1 fixes the issue. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-21886, GHSA-mhmx-j75v-2m6x, PYSEC-2026-117
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-m7xr-bwh3-wkg1 |
|
| 5 |
| url |
VCID-vb19-z3p4-9yc9 |
| vulnerability_id |
VCID-vb19-z3p4-9yc9 |
| summary |
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 6.9.7, an organization admin can escalate their privileges by adding a user from a different organization with higher privileges, to their own organization. This is due to incorrect ACL on userEdit relationAdd. This vulnerability is fixed in 6.9.7. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-44730, GHSA-q537-qhj4-wcjx, PYSEC-2026-167
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-vb19-z3p4-9yc9 |
|
|
|---|