A critical authorization bypass vulnerability in the OpenCTI platform allows authenticated users to perform unauthorized deletions of dashboards and investigation cases, risking significant data loss.

The vulnerability exists within the WorkspacePopoverDeletionMutation GraphQL mutation, which fails to perform necessary authorization checks to verify user ownership of targeted resources. An authenticated attacker can supply the UUID of a resource they do not own to trigger its deletion, resulting in unauthorized data modification or removal.

The ability for any authenticated user to delete shared workspaces, including critical dashboards and investigation cases, poses a severe risk to the integrity of threat intelligence operations. This vulnerability could lead to the loss of irreplaceable intelligence data and disrupt ongoing security analysis workflows. Given the CVSS score of 7.1, this is considered a High severity issue that requires immediate attention to prevent unauthorized destructive actions within the platform.

Immediate Action: Update the OpenCTI platform to version 6.8.1 or later, which includes the necessary authorization checks to prevent unauthorized resource deletion.

Proactive Monitoring: Review audit logs for unusual deletion activity or frequent GraphQL mutation calls originating from non-administrative user accounts.

Compensating Controls: Implement strict access control policies and review user permissions within the OpenCTI interface to limit the scope of actions available to standard users until the patch is applied.

Public Exploit Available: Unknown

The vulnerability represents a significant risk to the integrity of intelligence data managed within OpenCTI. Administrators must prioritize updating the platform to version 6.8.1 immediately to close the authorization gap. Failure to patch allows any authenticated user to compromise the availability and integrity of global workspaces, which could severely hinder incident response and threat monitoring capabilities.