High · published January 5, 2026
⚡ A sneaky GraphQL mutation lets anyone delete your entire workspace without breaking a sweat! Just a UUID is all it takes. 🔥 Think of it like a restaurant where anyone can walk in and take over a table simply by showing a reservation number that isn’t theirs — no questions asked! This is exactly what happens with the WorkspacePopoverDeletionMutation in OpenCTI before version 6.8.1. An attacker could wipe out dashboards and investigation cases, essentially erasing crucial threat intelligence resources. Picture losing all your important files due to a careless dinner guest — absolutely devastating!
Think of it like a restaurant where anyone can walk in and take over a table simply by showing a reservation number that isn’t theirs — no questions asked! This is exactly what happens with the WorkspacePopoverDeletionMutation in OpenCTI before version 6.8.1. This vulnerability arises because the GraphQL mutation allows resource deletion without verifying that the requester owns the object. As a result, any active UUID can trigger a deletion, bypassing vital authorization checks.
An attacker could wipe out dashboards and investigation cases, essentially erasing crucial threat intelligence resources. Picture losing all your important files due to a careless dinner guest — absolutely devastating! Upgrade OpenCTI to version 6.8.1 immediately to patch this vulnerability. Additionally, review your access controls and ensure proper checks are in place for all mutations. Don't let the wrong hands wield such power! This is fixable! Follow these steps and you'll be back in control in no time. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| citeum/opencti | < 6.8.1 | 6.8.1 |