CVE-2026-21886

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.9.1, the GraphQL mutations "IndividualDeletionDeleteMutation" is intended to allow users to delete individual entity objects respectively. However, it was observed that this mutation can be misused to delete unrelated and sensitive objects such as analyses reports etc. This behavior stems from the lack of validation in the API to ensure that the targeted object is contextually related to the mutation being executed. Version 6.9.1 fixes the issue.

• CWE-285
• CWE-566
• CWE-915

• https://github.com/OpenCTI-Platform/opencti/security/advisories/GHSA-mhmx-j75v-2m6xVendor Advisory

Published

Mar 17, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-21880Kanboard is project management software focused on Kanban me…5.3
• CVE-2026-21881Kanboard is project management software focused on Kanban me…9.1
• CVE-2026-21882theshit is a command-line utility that automatically detects…8.4
• CVE-2026-21883Bokeh is an interactive visualization library written in Pyt…5.4
• CVE-2026-21884React Router is a router for React. In @remix-run/react vers…8.2
• CVE-2026-21885Miniflux 2 is an open source feed reader. Prior to version 2…6.5
• CVE-2026-21887OpenCTI is an open source platform for managing cyber threat…7.7
• CVE-2026-21888NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging …7.5
• CVE-2026-21889Weblate is a web based localization tool. Prior to 5.15.2, t…7.5
• CVE-2026-2189A vulnerability was identified in itsourcecode School Manage…9.8
• CVE-2026-21891ZimaOS is a fork of CasaOS, an operating system for Zima dev…9.8
• CVE-2026-21892Parsl is a Python parallel scripting library. A SQL Injectio…7.3