CVE-2026-21886

OpenCTI's GraphQL Mutations Allow Deletion of Unrelated Entities

State: Published
Severity: 6.5 Medium
Published: Mar 17, 2026
Updated: Mar 17, 2026
Reserved: Jan 5, 2026

Description

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.9.1, the GraphQL mutations "IndividualDeletionDeleteMutation" is intended to allow users to delete individual entity objects respectively. However, it was observed that this mutation can be misused to delete unrelated and sensitive objects such as analyses reports etc. This behavior stems from the lack of validation in the API to ensure that the targeted object is contextually related to the mutation being executed. Version 6.9.1 fixes the issue.

Scores

CVSS	Score	Vector	Source
3.1	6.5 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H	GitHub_M

Weaknesses

CWE-285 Improper Authorization
CWE-566 Authorization Bypass Through User-Controlled SQL Primary Key
CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes

Affected Products

Product	Versions
openctiOpenCTI-Platform	< 6.9.1Affected

References

https://github.com/OpenCTI-Platform/opencti/security/advisories/GHSA-mhmx-j75v-2m6x

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.