OpenCTI's GraphQL IDOR enables authenticated users to modify or delete notifications of other users

Description

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.6.6, an IDOR vulnerability in the GrapQL `NotificationLineNotificationMarkReadMutation` and `NotificationLineNotificationDeleteMutation` mutations of OpenCTI allows an authenticated user to change the read status of a notification or delete a notification of another user in case he has knowledge of the UUID of the notification. When changing the read status of a notification, the user also receives the content of the notification they changed the read status of. Authenticated Users in OpenCTI can read, modify and delete notification of other users if they know the UUID of the notification. Version 6.6.6 fixes the issue.

Scores

EPSS (exploitation in 30 days)

0.24% · top 85% of all CVEs (6 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.4.

Weakness

• CWE-285: Improper Authorization (opens in a new tab)All about CWE-285 and its CVEs

Affected products

• OpenCTI-Platform · opencti

  • affected < 6.6.6

References (1)

• https://github.com/OpenCTI-Platform/opencti/security/advisories/GHSA-535g-qp2c-h7vp (opens in a new tab)x_refsource_CONFIRM

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2025-46732](https://trackcve.app/badge/CVE-2025-46732.svg)](https://trackcve.app/cve/CVE-2025-46732)

Record last updated 18 Jul 2025, 15:24 UTC.