Search for packages
| purl | pkg:pypi/pycti@6.7.9 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-8vjm-472q-tbh4
Aliases: CVE-2026-21886 GHSA-mhmx-j75v-2m6x PYSEC-2026-117 |
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.9.1, the GraphQL mutations "IndividualDeletionDeleteMutation" is intended to allow users to delete individual entity objects respectively. However, it was observed that this mutation can be misused to delete unrelated and sensitive objects such as analyses reports etc. This behavior stems from the lack of validation in the API to ensure that the targeted object is contextually related to the mutation being executed. Version 6.9.1 fixes the issue. |
Affected by 2 other vulnerabilities. |
|
VCID-ct6q-13vx-dbhk
Aliases: CVE-2025-61781 GHSA-pr6m-q4g7-342c PYSEC-2026-116 |
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.8.1, the GraphQL mutation "WorkspacePopoverDeletionMutation" allows users to delete workspace-related objects such as dashboards and investigation cases. However, the mutation lacks proper authorization checks to verify ownership of the targeted resources. An attacker can exploit this by supplying an active UUID of another user. Since the API does not validate whether the requester owns the resource, the mutation executes successfully, resulting in unauthorized deletion of the entire workspace. Version 6.8.1 fixes the issue. |
Affected by 3 other vulnerabilities. |
|
VCID-gwy3-beaz-cqg8
Aliases: CVE-2026-21887 GHSA-ffm6-vvph-g5f5 PYSEC-2026-118 |
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 6.8.16, the OpenCTI platform’s data ingestion feature accepts user-supplied URLs without validation and uses the Axios HTTP client with its default configuration (allowAbsoluteUrls: true). This allows attackers to craft requests to arbitrary endpoints, including internal services, because Axios will accept and process absolute URLs. This results in a semi-blind SSRF, as responses may not be fully visible but can still impact internal systems. This vulnerability is fixed in 6.8.16. |
Affected by 2 other vulnerabilities. |
|
VCID-pdyx-j197-6faj
Aliases: CVE-2026-44730 GHSA-q537-qhj4-wcjx PYSEC-2026-167 |
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 6.9.7, an organization admin can escalate their privileges by adding a user from a different organization with higher privileges, to their own organization. This is due to incorrect ACL on userEdit relationAdd. This vulnerability is fixed in 6.9.7. |
Affected by 1 other vulnerability. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||