CVE-2026-21886: Citeum OpenCTI Auth Bypass Vulnerability

CVE-2026-21886 Overview

CVE-2026-21886 is an authorization bypass vulnerability in OpenCTI, an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.9.1, the GraphQL mutation IndividualDeletionDeleteMutation is intended to allow users to delete individual entity objects. However, it was observed that this mutation can be misused to delete unrelated and sensitive objects such as analyses reports. This behavior stems from the lack of validation in the API to ensure that the targeted object is contextually related to the mutation being executed.

Critical Impact

Authenticated attackers can exploit insufficient authorization checks in the GraphQL API to delete arbitrary sensitive objects including critical analysis reports and threat intelligence data, causing significant integrity and availability impact to the CTI platform.

Affected Products

• Citeum OpenCTI versions prior to 6.9.1

Discovery Timeline

• 2026-03-17 - CVE CVE-2026-21886 published to NVD
• 2026-03-19 - Last updated in NVD database

Technical Details for CVE-2026-21886

Vulnerability Analysis

This vulnerability is classified under CWE-285 (Improper Authorization), which occurs when the software does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. In the context of OpenCTI, the GraphQL API endpoint fails to validate whether the requesting user has the appropriate contextual permissions to delete specific objects.

The vulnerability allows an authenticated user with low privileges to exceed their intended access boundaries. Through the IndividualDeletionDeleteMutation GraphQL operation, attackers can target and delete objects that should be restricted based on their role or relationship to those objects. This includes sensitive threat intelligence artifacts such as analysis reports, indicators of compromise, and other critical CTI data.

The impact is particularly severe in multi-tenant or team-based OpenCTI deployments where data isolation between users and roles is essential for maintaining operational security and data integrity.

Root Cause

The root cause of this vulnerability lies in the insufficient validation logic within the GraphQL mutation handler. The IndividualDeletionDeleteMutation endpoint does not verify that the object identifier provided in the deletion request corresponds to an object type that the mutation is contextually designed to handle. This allows attackers to supply arbitrary object identifiers, effectively bypassing the intended object-type restrictions.

The API accepts any valid object ID without checking whether the object type matches the expected entity type for the mutation, enabling cross-entity deletion operations that violate the application's authorization model.

Attack Vector

The attack vector is network-based and requires low privileges (authenticated access). An attacker with valid credentials to the OpenCTI platform can craft malicious GraphQL requests targeting the vulnerable mutation endpoint. By supplying object identifiers of sensitive resources they should not have access to, they can delete critical threat intelligence data.

The exploitation process involves:

1. Authenticating to the OpenCTI platform with any valid user account
2. Identifying target object identifiers for sensitive resources (analysis reports, threat data)
3. Crafting GraphQL mutation requests using IndividualDeletionDeleteMutation with the target object IDs
4. Executing the requests to delete the targeted sensitive objects

For technical details on exploitation, refer to the GitHub Security Advisory.

Detection Methods for CVE-2026-21886

Indicators of Compromise

• Unexpected deletion of analysis reports, indicators, or other CTI objects from the platform
• GraphQL API logs showing IndividualDeletionDeleteMutation operations against non-individual entity types
• Audit trail anomalies where users delete objects outside their normal scope of responsibility
• Sudden loss of threat intelligence data or correlation breakages in the platform

Detection Strategies

• Monitor GraphQL API logs for IndividualDeletionDeleteMutation requests targeting object types other than individual entities
• Implement alerting on deletion operations performed against high-value or protected object categories
• Review audit logs for users performing bulk or unusual deletion patterns
• Cross-reference deletion events with user role permissions to identify authorization violations

Monitoring Recommendations

• Enable comprehensive audit logging for all GraphQL mutation operations in OpenCTI
• Configure SIEM rules to detect anomalous deletion activity patterns across the CTI platform
• Implement object deletion rate limiting and alerting thresholds for individual user accounts
• Establish baseline deletion behavior metrics to identify deviations indicative of exploitation

How to Mitigate CVE-2026-21886

Immediate Actions Required

• Upgrade OpenCTI to version 6.9.1 or later immediately
• Review audit logs for any suspicious deletion activity that may indicate prior exploitation
• Restore any deleted critical objects from backups if exploitation evidence is found
• Temporarily restrict GraphQL API access to trusted users until patching is complete

Patch Information

The vulnerability has been addressed in OpenCTI version 6.9.1. Organizations should upgrade to this version or later to remediate the authorization bypass. The fix implements proper object type validation within the IndividualDeletionDeleteMutation handler to ensure only contextually appropriate objects can be deleted. For complete patch details, see the GitHub Security Advisory.

Workarounds

• Implement network-level access controls to restrict GraphQL API access to authorized IP ranges only
• Use a reverse proxy or API gateway to filter and validate GraphQL mutation requests before they reach OpenCTI
• Reduce the number of user accounts with delete permissions to minimize the attack surface
• Enable read-only mode for non-administrative users until the patch can be applied

# Configuration example - Restrict API access via firewall rules
# Allow GraphQL API access only from trusted management networks
iptables -A INPUT -p tcp --dport 8080 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP