The OpenCTI GraphQL mutation "IndividualDeletionDeleteMutation" was designed to delete individual entity objects. However, due to missing validation of the target object’s relationship with the mutation, an attacker can delete unrelated and sensitive entities such as analysis reports. This flaw is an authorization bypass and permission escalation vulnerability (CWE-285, CWE-566, CWE-915). The consequence is loss of critical threat intelligence, potentially compromising the integrity of the knowledge base and hindering future threat analysis.

OpenCTI-Platform (opencti) versions prior to 6.9.1 are affected. The fix was released in version 6.9.1, which adds contextual validation to the mutation.

The vulnerability carries a CVSS score of 6.5, indicating a moderate severity. EPSS indicates a less than 1% probability of exploitation, and the issue is not listed in the CISA KEV catalog. Based on the description, it is inferred that the likely attack vector is authenticated GraphQL API calls; an attacker with any level of user access may exploit the mutation to delete unwanted data if the system has not been updated to 6.9.1 or later.