CVE-2026-21886
Improper Authorization in OpenCTI GraphQL Causes Data Deletion
Publication date: 2026-03-17
Last updated on: 2026-03-19
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| citeum | opencti | to 6.9.1 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-915 | The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified. |
| CWE-566 | The product uses a database table that includes records that should not be accessible to an actor, but it executes a SQL statement with a primary key that can be controlled by that actor. |
| CWE-285 | The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': 'CVE-2026-21886 is a moderate severity vulnerability in the OpenCTI platform versions prior to 6.9.1. It involves the GraphQL mutation called "IndividualDeletionDeleteMutation," which is intended to delete individual entity objects.'}, {'type': 'paragraph', 'content': 'The vulnerability arises because this mutation lacks proper validation to ensure that the object being deleted is contextually related to the mutation. As a result, attackers can misuse this mutation to delete unrelated and sensitive objects such as analysis reports, incident response cases, and threat actor records.'}, {'type': 'paragraph', 'content': 'This issue is caused by missing or incorrect authorization checks and improper control over which object attributes can be modified, allowing attackers with low privileges to perform unauthorized deletions remotely without user interaction.'}] [1]
How can this vulnerability impact me? :
This vulnerability can impact you by allowing attackers to delete sensitive and unrelated data within the OpenCTI platform, such as analysis reports and threat intelligence records.
Such unauthorized deletions affect the availability of critical data, potentially disrupting cyber threat intelligence operations and incident response efforts.
However, the vulnerability does not impact confidentiality or integrity of the data, only availability.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability involves misuse of the GraphQL mutation "IndividualDeletionDeleteMutation" in OpenCTI versions prior to 6.9.1, allowing unauthorized deletion of unrelated sensitive objects.'}, {'type': 'paragraph', 'content': 'To detect exploitation attempts on your network or system, monitor GraphQL API requests for calls to the "IndividualDeletionDeleteMutation" mutation, especially those that attempt to delete objects outside the expected scope.'}, {'type': 'paragraph', 'content': 'You can use network traffic inspection tools or API logging to identify suspicious mutation requests.'}, {'type': 'paragraph', 'content': 'Example commands to detect such activity might include:'}, {'type': 'list_item', 'content': "Using grep on API logs to find mutation calls: grep -i 'IndividualDeletionDeleteMutation' /path/to/opencti/api/logs.log"}, {'type': 'list_item', 'content': "Using tcpdump or Wireshark to capture and filter GraphQL HTTP POST requests containing the mutation name: tcpdump -A -s 0 'tcp port 4000 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' | grep 'IndividualDeletionDeleteMutation'"}, {'type': 'list_item', 'content': 'Querying OpenCTI logs or monitoring tools for unusual deletion events or unexpected deletions of analysis reports, incident cases, or threat actor records.'}] [1]
What immediate steps should I take to mitigate this vulnerability?
The primary mitigation step is to upgrade OpenCTI to version 6.9.1 or later, where this vulnerability has been fixed.
Until the upgrade can be performed, consider restricting access to the GraphQL API to trusted users only, especially limiting users with privileges to perform deletions.
Implement network-level controls such as firewall rules or API gateways to block or monitor suspicious mutation requests.
Review and tighten authorization policies to ensure that users cannot perform deletions outside their intended scope.