PT-2026-1316 · Opencti · Opencti

Published 2026-01-05 · Updated 2026-01-30 · CVE-2025-61781

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenCTI versions prior to 6.8.1

Description OpenCTI is a platform for managing cyber threat intelligence knowledge and observables. The GraphQL mutation WorkspacePopoverDeletionMutation lacks proper authorization checks, allowing users to delete workspace-related objects, such as dashboards and investigation cases, without verifying ownership. An attacker can exploit this by providing an active UUID belonging to another user. Because the API does not validate resource ownership, the mutation executes successfully, leading to unauthorized deletion of workspace data.

Recommendations Update to version 6.8.1 or later to resolve this issue.

Exploit

Fix

Improper Authorization

Incorrect Authorization

Weakness Enumeration

CWE-566

CWE-285

CWE-863

CWE-915

Related Identifiers

CVE-2025-61781

GHSA-PR6M-Q4G7-342C

PYSEC-2026-116

Affected Products

Opencti

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/61xxx/CVE-2025-61781.json · Exploit
• https://github.com/OpenCTI-Platform/opencti/security/advisories/GHSA-pr6m-q4g7-342c · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-61781 · Security Note
• https://osv.dev/vulnerability/PYSEC-2026-116 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-61781 · Vendor Advisory
• https://twitter.com/CCBalert/status/2008831724814217618 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2008253936478629984 · Twitter Post
• https://twitter.com/CVEnew/status/2008251285645180943 · Twitter Post
• https://t.me/cveNotify/150352 · Telegram Post