CVE-2026-21886
OpenCTI's GraphQL Mutations Allow Deletion of Unrelated Entities
CVSS Score
6.5
EPSS Score
0.0%
EPSS Percentile
0th
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.9.1, the GraphQL mutations "IndividualDeletionDeleteMutation" is intended to allow users to delete individual entity objects respectively. However, it was observed that this mutation can be misused to delete unrelated and sensitive objects such as analyses reports etc. This behavior stems from the lack of validation in the API to ensure that the targeted object is contextually related to the mutation being executed. Version 6.9.1 fixes the issue.
| CWE | CWE-285 CWE-566 CWE-915 |
| Vendor | opencti-platform |
| Product | opencti |
| Published | Mar 17, 2026 |
| Last Updated | Mar 17, 2026 |
Stay Ahead of the Next One
Get instant alerts for opencti-platform opencti
Be the first to know when new medium vulnerabilities affecting opencti-platform opencti are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Affected Versions
OpenCTI-Platform / opencti
< 6.9.1