---
cve: "CVE-2025-61781"
severity: "HIGH"
cvss: 7.1
epss: "0.2%"
vendor: "OpenCTI-Platform"
kev: false
exploited: false
published: "2026-01-05 18:15:44"
tags: [cve, security, high]
source: tsecurity.de CVE-Dossier
exported: "2026-11-09T15:27:39+01:00"
---

# CVE-2025-61781

> 7.1 HIGH · 🧪 PoC

## Beschreibung

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.8.1, the GraphQL mutation "WorkspacePopoverDeletionMutation" allows users to delete workspace-related objects such as dashboards and investigation cases. However, the mutation lacks proper authorization checks to verify ownership of the targeted resources.
An attacker can exploit this by supplying an active UUID of another user. Since the API does not validate whether the requester owns the resource, the mutation executes successfully, resulting in unauthorized deletion of the entire workspace. Version 6.8.1 fixes the issue.

## CNA-Record (Kanon, cvelistV5)

- CNA: **GitHub_M**
- State: PUBLISHED
- Stand: 2026-01-05 19:43:45
- CNA-CVSS: **7.1** (`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H`)

## CISA-Anreicherung (vulnrichment/ADP)

- CISA-SSVC (Coordinator, v2.0.3):
  - Exploitation: **none**
  - Automatable: **no**
  - Technical Impact: **partial**

## CVSS-Vektor

```
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Gering | warn |
| UI Interaktion | Keine | bad |
| S Scope | Unverändert | good |
| C Vertraulichkeit | Keine | good |
| I Integrität | Gering | warn |
| A Verfügbarkeit | Hoch | bad |

## Schwachstellen-Klasse

- **CWE-285** — Improper Authorization
  The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
- **CWE-566** — Authorization Bypass Through User-Controlled SQL Primary Key
  The product uses a database table that includes records that should not be accessible to an actor, but it executes a SQL statement with a primary key that can be controlled by that actor.
- **CWE-915** — Improperly Controlled Modification of Dynamically-Determined Object Attributes
  The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.
- **CWE-863** — Incorrect Authorization
  The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

## Angriffsmuster (CAPEC)

- [CAPEC-1 — Accessing Functionality Not Properly Constrained by ACLs](https://capec.mitre.org/data/definitions/1.html) _(Severity: High)_
- [CAPEC-13 — Subverting Environment Variable Values](https://capec.mitre.org/data/definitions/13.html) _(Severity: Very High)_
- [CAPEC-17 — Using Malicious Files](https://capec.mitre.org/data/definitions/17.html) _(Severity: Very High)_
- [CAPEC-39 — Manipulating Opaque Client-based Data Tokens](https://capec.mitre.org/data/definitions/39.html) _(Severity: Medium)_
- [CAPEC-45 — Buffer Overflow via Symbolic Links](https://capec.mitre.org/data/definitions/45.html) _(Severity: High)_
- [CAPEC-104 — Cross Zone Scripting](https://capec.mitre.org/data/definitions/104.html) _(Severity: High)_
- [CAPEC-127 — Directory Indexing](https://capec.mitre.org/data/definitions/127.html) _(Severity: Medium)_
- [CAPEC-402 — Bypassing ATA Password Security](https://capec.mitre.org/data/definitions/402.html)

## ATT&CK-Techniken

- [T1574.010 — Hijack Execution Flow: ServicesFile Permissions Weakness](https://attack.mitre.org/techniques/T1574/010/)
- [T1562.003 — Impair Defenses:Impair Command History Logging](https://attack.mitre.org/techniques/T1562/003/)
- [T1574.006 — Hijack Execution Flow:Dynamic Linker Hijacking](https://attack.mitre.org/techniques/T1574/006/)
- [T1574.007 — Hijack Execution Flow:Path Interception by PATH Environment ](https://attack.mitre.org/techniques/T1574/007/)
- [T1574.005 — Hijack Execution Flow: Executable Installer File Permissions](https://attack.mitre.org/techniques/T1574/005/)
- [T1083 — File and Directory Discovery](https://attack.mitre.org/techniques/T1083/)

## Patch verfügbar (OSV)

- 47b03b000f728a87737ce6cab910689acfa7c94b (Commit)

## BSI-Hinweise (deutsch)

- [OpenCTI: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen, Manipulation von Daten, Denial of Service](https://wid.cert-bund.de/portal/wid/sicherheitshinweis/WID-SEC-W-2026-0006) — _BSI-Einstufung: mittel_
  Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in OpenCTI ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um Daten zu manipulieren, um einen Denial of Service Angriff durchzuführen

## Referenzen

- <https://github.com/OpenCTI-Platform/opencti/security/advisories/GHSA-pr6m-q4g7-342c>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/sicherheitsluecken/cve-2025-61781/) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_