CVE-2025-61781 is a high severity authorization flaw in OpenCTI, the threat intelligence platform, scored CVSS 7.1. A GraphQL mutation deletes workspace objects without checking who owns them. Any signed in user could remove another user's dashboards or cases. Upgrade to 6.8.1.
What's affected
The GitHub advisory says OpenCTI versions below 6.8.1 are affected and 6.8.1 or later is patched. It was published on 5 January 2026. The record tags four weaknesses: CWE-285 (improper authorization), CWE-566 (authorization bypass through a user controlled SQL primary key), CWE-863 (incorrect authorization) and CWE-915 (improperly controlled modification of dynamically determined object attributes).
The mutation named in the advisory is WorkspacePopoverDeletionMutation. It lets users delete workspace objects such as dashboards and investigation cases, and it did not verify that the caller owns the target. The attacker needs a signed in account and the identifier of another user's object.
How to check if you're exposed
Find your OpenCTI version in the platform interface or from the container image tag you run. If it is below 6.8.1, you are affected.
Then consider who has accounts. The flaw needs a signed in user, so a platform shared among many analysts, partners or connectors has more exposure than a small private one.
Look for unexplained disappearance of dashboards or investigation cases, and compare against your backups. Review API access logs for deletion mutations from accounts that should not be removing others' work.
What to do now
- Upgrade OpenCTI to 6.8.1 or later, following the project's upgrade notes.
- Back up the platform's data before upgrading, and test the restore path.
- Review accounts and remove those that no longer need access.
- Check for missing dashboards or cases and restore them from backup if needed.
- Add authorization tests to your own custom connectors or API clients that call workspace mutations.
Why it matters
This is an insecure direct object reference. The mutation accepts an identifier and acts on it, but it does not ask whether the caller may act on that object. In the weakness list this appears as CWE-285 and CWE-863, improper and incorrect authorization.
The advisory describes the damage plainly. Dashboards hold tailored views and monitoring set ups. Investigation cases can hold evidence, timelines and analyst notes, which an incident team cannot easily recreate. The advisory also notes that an attacker could aim at high value users, such as administrators and analysts, to sabotage detection or delay response.
GraphQL makes this class easy to miss, because every field and mutation needs its own check, and a schema that looks tidy can hide an unprotected resolver. The way to catch it is to test each mutation with two different users, one who owns the object and one who does not. An API scan that exercises operations with different roles covers the same ground. The KEV flag is false.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Can an anonymous visitor do this?
No. The advisory describes an authenticated user, with low privileges, supplying another user's object identifier.
What data is at risk?
Deletion of dashboards and investigation cases, which the advisory says can be irreversible without a backup.
Sources
Last reviewed: 19 October 2026.
