Search for packages
| purl | pkg:pypi/pycti@6.1.1 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-3xr5-76g9-rfet
Aliases: CVE-2024-45404 GHSA-hg56-r6hh-56j7 PYSEC-2024-297 |
OpenCTI is an open-source cyber threat intelligence platform. In versions below 6.2.18, because the function to limit the rate of OTP does not exist, an attacker with valid credentials or a malicious user who commits internal fraud can break through the two-factor authentication and hijack the account. This is because the otpLogin mutation does not implement One Time Password rate limiting. As of time of publication, it is unknown whether a patch is available. |
Affected by 7 other vulnerabilities. |
|
VCID-667x-utu7-augw
Aliases: CVE-2025-46732 GHSA-535g-qp2c-h7vp PYSEC-2025-181 |
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.6.6, an IDOR vulnerability in the GrapQL `NotificationLineNotificationMarkReadMutation` and `NotificationLineNotificationDeleteMutation` mutations of OpenCTI allows an authenticated user to change the read status of a notification or delete a notification of another user in case he has knowledge of the UUID of the notification. When changing the read status of a notification, the user also receives the content of the notification they changed the read status of. Authenticated Users in OpenCTI can read, modify and delete notification of other users if they know the UUID of the notification. Version 6.6.6 fixes the issue. |
Affected by 4 other vulnerabilities. |
|
VCID-6b1v-kmst-aqgd
Aliases: CVE-2025-26621 PYSEC-2025-180 |
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.5.2, any user with the capability manage customizations can edit webhook that will execute javascript code. This can be abused to cause a denial of service attack by prototype pollution, making the node js server running the OpenCTI frontend become unavailable. Version 6.5.2 fixes the issue. |
Affected by 5 other vulnerabilities. |
|
VCID-8vjm-472q-tbh4
Aliases: CVE-2026-21886 GHSA-mhmx-j75v-2m6x PYSEC-2026-117 |
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.9.1, the GraphQL mutations "IndividualDeletionDeleteMutation" is intended to allow users to delete individual entity objects respectively. However, it was observed that this mutation can be misused to delete unrelated and sensitive objects such as analyses reports etc. This behavior stems from the lack of validation in the API to ensure that the targeted object is contextually related to the mutation being executed. Version 6.9.1 fixes the issue. |
Affected by 2 other vulnerabilities. |
|
VCID-ct6q-13vx-dbhk
Aliases: CVE-2025-61781 GHSA-pr6m-q4g7-342c PYSEC-2026-116 |
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.8.1, the GraphQL mutation "WorkspacePopoverDeletionMutation" allows users to delete workspace-related objects such as dashboards and investigation cases. However, the mutation lacks proper authorization checks to verify ownership of the targeted resources. An attacker can exploit this by supplying an active UUID of another user. Since the API does not validate whether the requester owns the resource, the mutation executes successfully, resulting in unauthorized deletion of the entire workspace. Version 6.8.1 fixes the issue. |
Affected by 3 other vulnerabilities. |
|
VCID-gwy3-beaz-cqg8
Aliases: CVE-2026-21887 GHSA-ffm6-vvph-g5f5 PYSEC-2026-118 |
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 6.8.16, the OpenCTI platform’s data ingestion feature accepts user-supplied URLs without validation and uses the Axios HTTP client with its default configuration (allowAbsoluteUrls: true). This allows attackers to craft requests to arbitrary endpoints, including internal services, because Axios will accept and process absolute URLs. This results in a semi-blind SSRF, as responses may not be fully visible but can still impact internal systems. This vulnerability is fixed in 6.8.16. |
Affected by 2 other vulnerabilities. |
|
VCID-jd8k-auea-5uh7
Aliases: CVE-2024-45805 GHSA-42mm-c8x3-g5q6 PYSEC-2024-298 |
OpenCTI is an open-source cyber threat intelligence platform. Before 6.3.0, general users can access information that can only be accessed by users with access privileges to admin and support information (SETTINGS_SUPPORT). This is due to inadequate access control for support information (http://<opencti_domain>/storage/get/support/UUID/UUID.zip), and that the UUID is available to general users using an attached query (logs query). This vulnerability is fixed in 6.3.0. |
Affected by 6 other vulnerabilities. |
|
VCID-pdyx-j197-6faj
Aliases: CVE-2026-44730 GHSA-q537-qhj4-wcjx PYSEC-2026-167 |
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 6.9.7, an organization admin can escalate their privileges by adding a user from a different organization with higher privileges, to their own organization. This is due to incorrect ACL on userEdit relationAdd. This vulnerability is fixed in 6.9.7. |
Affected by 1 other vulnerability. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||