CVE-2025-46732

Executive Summary

CVE-2025-46732 is an Insecure Direct Object Reference (IDOR) vulnerability in OpenCTI, an open-source platform for managing cyber threat intelligence knowledge and observables. The flaw resides in the GraphQL NotificationLineNotificationMarkReadMutation and NotificationLineNotificationDeleteMutation mutations. An authenticated attacker who knows the UUID of another user's notification can change its read status or delete it. When changing the read status, the attacker also receives the content of the notification, leading to unauthorized information disclosure. The vulnerability is rated with a CVSS score of 5.4 (Medium). The patch is available in version 6.6.6.

Supply Chain & Package Security

OpenCTI is a Python-based application. The vulnerability is in the application logic, not in a dependency. However, organizations should ensure they are using a trusted distribution of OpenCTI (e.g., official Docker images or PyPI packages) and verify the integrity of the update to version 6.6.6.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – The attacker must be authenticated.
• User Interaction (UI): None (N) – No user action is required.
• Scope (S): Unchanged (U) – The impact is confined to the vulnerable component.
• Confidentiality (C): Low (L) – Limited information disclosure (notification content).
• Integrity (I): Low (L) – The attacker can modify the read status or delete notifications.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. The vulnerability requires authentication and knowledge of the target notification UUID, but it can lead to unauthorized access to sensitive CTI data.

Deep Dive & Mechanics

The vulnerability is an Insecure Direct Object Reference (CWE-639) in the GraphQL API of OpenCTI. The mutations NotificationLineNotificationMarkReadMutation and NotificationLineNotificationDeleteMutation accept a notification UUID as input but fail to verify that the requesting user owns that notification. This allows an authenticated user to:

1. Mark another user's notification as read/unread – The attacker can change the read status of any notification if they know its UUID.
2. Delete another user's notification – The attacker can delete any notification if they know its UUID.
3. Read the content of another user's notification – When changing the read status, the mutation returns the notification content, which the attacker can then view.

The vulnerability is exploitable via GraphQL queries. An attacker would need to enumerate or guess notification UUIDs, which are typically UUIDv4 and not easily guessable. However, if UUIDs are leaked through other means (e.g., logs, error messages, or other API endpoints), the attacker can exploit this flaw.

Vulnerable vs. Patched Code

Vulnerable Code (pre-6.6.6): The mutations do not include an authorization check to verify that the notification belongs to the requesting user.

# Vulnerable mutation (simplified)
class NotificationLineNotificationMarkReadMutation(graphene.Mutation):
    class Arguments:
        id = graphene.ID(required=True)

    def mutate(self, info, id):
        notification = Notification.objects.get(id=id)
        notification.read = True
        notification.save()
        return NotificationLineNotificationMarkReadMutation(notification=notification)

Patched Code (6.6.6): The patched version adds an authorization check to ensure the notification belongs to the requesting user.

# Patched mutation (simplified)
class NotificationLineNotificationMarkReadMutation(graphene.Mutation):
    class Arguments:
        id = graphene.ID(required=True)

    def mutate(self, info, id):
        user = info.context.user
        notification = Notification.objects.get(id=id)
        if notification.user != user:
            raise PermissionDenied("You do not have permission to modify this notification.")
        notification.read = True
        notification.save()
        return NotificationLineNotificationMarkReadMutation(notification=notification)

Exploitation & Lab Setup

Red Team

Prerequisites:

• An authenticated session in OpenCTI.
• Knowledge of a target notification UUID.

Exploitation Steps:

1. Obtain a valid session token by logging in to OpenCTI.
2. Identify a target notification UUID (e.g., through other API endpoints, logs, or social engineering).
3. Send a GraphQL mutation to mark the notification as read (which also returns its content):

mutation {
  NotificationLineNotificationMarkReadMutation(id: "TARGET_UUID") {
    notification {
      id
      content
      read
    }
  }
}

4. Alternatively, delete the notification:

mutation {
  NotificationLineNotificationDeleteMutation(id: "TARGET_UUID") {
    success
  }
}

Lab Setup:

• Deploy a vulnerable version of OpenCTI (e.g., 6.6.5) using Docker.
• Create two user accounts: attacker and victim.
• As victim, generate a notification (e.g., by creating a report or receiving an alert).
• As attacker, use the GraphQL endpoint to exploit the vulnerability.

Blue Team

Detection:

• Monitor GraphQL API logs for mutations to NotificationLineNotificationMarkReadMutation or NotificationLineNotificationDeleteMutation where the id parameter does not match the user's own notifications.
• Alert on multiple failed attempts to access notifications (potential UUID enumeration).
• Use the Sigma rule provided in the Detection Engineering section.

Mitigation:

• Immediately upgrade to OpenCTI version 6.6.6 or later.
• If immediate patching is not possible, implement a Web Application Firewall (WAF) rule to block GraphQL mutations that attempt to access notifications with UUIDs not belonging to the authenticated user.
• Restrict API access to trusted IP ranges.

Indicators of Compromise (IOCs)

• GraphQL Query Patterns:
  • NotificationLineNotificationMarkReadMutation with an id parameter that does not match the user's own notifications.
  • NotificationLineNotificationDeleteMutation with an id parameter that does not match the user's own notifications.
• Log Entries:
  • Unauthorized access attempts to notification mutations.
  • Multiple NotificationLineNotificationMarkReadMutation calls from the same user in a short period.
• Network Traffic:
  • POST requests to /graphql with mutation payloads containing NotificationLineNotificationMarkReadMutation or NotificationLineNotificationDeleteMutation.

Detection Engineering

YARA Rule

rule CVE_2025_46732_OpenCTI_IDOR {
    meta:
        description = "Detects GraphQL mutations exploiting CVE-2025-46732 in OpenCTI"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-46732"
    strings:
        $mutation1 = "NotificationLineNotificationMarkReadMutation"
        $mutation2 = "NotificationLineNotificationDeleteMutation"
        $uuid_pattern = /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/
    condition:
        any of ($mutation*) and $uuid_pattern
}

Sigma Rule

title: CVE-2025-46732 - OpenCTI IDOR Notification Manipulation
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit CVE-2025-46732 by manipulating notifications of other users in OpenCTI.
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-46732
logsource:
    category: application
    product: opencti
detection:
    selection:
        event: "graphql_query"
        query|contains:
            - "NotificationLineNotificationMarkReadMutation"
            - "NotificationLineNotificationDeleteMutation"
    condition: selection
falsepositives:
    - Legitimate use by administrators
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-46732 OpenCTI IDOR Notification Manipulation"; flow:to_server,established; content:"POST"; http_method; content:"/graphql"; http_uri; content:"NotificationLineNotificationMarkReadMutation"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade OpenCTI to version 6.6.6 or later. This is the only complete fix.
2. If patching is delayed, implement a WAF rule to block GraphQL mutations that attempt to access notifications with UUIDs not belonging to the authenticated user.
3. Review API access logs for any signs of exploitation.

Long-Term Measures:

• Implement proper authorization checks in all GraphQL mutations.
• Conduct regular security audits of the application.
• Use a Web Application Firewall (WAF) to monitor and block suspicious GraphQL queries.
• Educate developers on secure coding practices, particularly regarding IDOR vulnerabilities.

Valters IT
Securing Your Digital Frontier