PT-2026-25902 · Opencti · Opencti

Daffyspider + 1 · Publicado 2026-03-17 · Atualizado 2026-03-17 · CVE-2026-21886

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenCTI versions prior to 6.9.1

Description OpenCTI is a platform for managing cyber threat intelligence knowledge and observables. A flaw exists in the 'IndividualDeletionDeleteMutation' GraphQL mutation, allowing the deletion of unrelated and sensitive objects, such as analysis reports. This is due to a lack of validation within the API, failing to confirm contextual relationships between the targeted object and the executed mutation.

Recommendations Update to version 6.9.1 or later.

Exploit

Correção

Improper Authorization

Enumeração de Fraquezas

CWE-566

CWE-285

CWE-915

Identificadores relacionados

CVE-2026-21886

GHSA-MHMX-J75V-2M6X

PYSEC-2026-117

Produtos afetados

Opencti

Referências · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/21xxx/CVE-2026-21886.json · Exploit
• https://github.com/OpenCTI-Platform/opencti/security/advisories/GHSA-mhmx-j75v-2m6x · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2033994273163825220 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-21886 · Aviso do Fabricante
• https://osv.dev/vulnerability/PYSEC-2026-117 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-21886 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/2033958420005401074 · Publicação no Twitter