Vulnerability in OpenCTI Platform Enabling Unauthorized Deletion of Sensitive Data

CVE-2026-21886

What is CVE-2026-21886?

OpenCTI, an open-source platform designed for managing cyber threat intelligence, has a vulnerability that allows malicious users to exploit GraphQL mutations, specifically 'IndividualDeletionDeleteMutation', to delete unrelated entities. This occurs due to insufficient validation in the API, which fails to ensure that the targeted object is appropriate and contextually related to the deletion action. This flaw enables users to potentially delete sensitive objects, including analysis reports, thereby compromising the integrity and security of the platform's data management. The issue was resolved in version 6.9.1, underscoring the importance of strict API validation.

References