CVE-2025-61781 OpenCTI-Platform CVE debrief

Who should care

Defenders and administrators of OpenCTI installations should be aware of this vulnerability and take necessary actions to prevent exploitation. They should verify their current version and upgrade to 6.8.1 or later if necessary.

Why it matters

CVE-2025-61781 is a high-severity vulnerability in OpenCTI that allows unauthorized deletion of workspace-related objects due to lack of proper authorization checks. Defenders should prioritize verifying and upgrading to OpenCTI version 6.8.1 or later to prevent exploitation.

• Potential unauthorized deletion of workspace-related objects
• Possible disruption of threat intelligence operations
• Need for verification of current OpenCTI version and upgrade to 6.8.1 or later
• Requirement for additional monitoring of workspace modifications

Technical summary

The vulnerability exists in the GraphQL mutation 'WorkspacePopoverDeletionMutation' in OpenCTI, allowing users to delete workspace-related objects without proper authorization checks. This can be exploited by supplying an active UUID of another user, leading to unauthorized deletion of the entire workspace. The issue was fixed in version 6.8.1. Defenders should prioritize verifying and upgrading to OpenCTI version 6.8.1 or later to prevent unauthorized workspace deletion. The vulnerability has a high severity score and can be exploited by attackers to disrupt threat intelligence operations.

Defensive priority

Defenders should prioritize verifying and upgrading to OpenCTI version 6.8.1 or later to prevent unauthorized workspace deletion. They should also monitor for suspicious activity related to workspace modifications.

Recommended defensive actions

• Verify and upgrade to OpenCTI version 6.8.1 or later
• Monitor for suspicious activity related to workspace modifications
• Restrict access to the GraphQL mutation 'WorkspacePopoverDeletionMutation'
• Implement additional authorization checks for workspace-related operations
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD vulnerability detail provide information on the vulnerability, its impact, and the fixed version. A vendor advisory is also available on GitHub. The vulnerability allows unauthorized deletion of workspace-related objects due to lack of proper authorization checks. Defenders should verify their current version and upgrade to 6.8.1 or later if necessary. Evidence from the CVE Program and NVD detail page supports this information. Limited source detail is available; explicit evidence-limit language and defensive (

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.