OpenCTI GraphQL IDOR Vulnerability in Notification Management Mutations

A vulnerability allowing Insecure Direct Object References (IDOR) has been identified in OpenCTI versions prior to 6.6.6. This vulnerability exists within the GraphQL `NotificationLineNotificationMarkReadMutation` and `NotificationLineNotificationDeleteMutation` mutations. It allows authenticated users to alter the read status of notifications or delete notifications belonging to other users, provided they know the UUID of the notification. Notably, when a user changes the read status of a notification, they also receive the content of that notification.

Impact

Exploitation of this vulnerability enables authenticated users to read, modify, and delete notifications of other users, given knowledge of the notification's UUID.

Remediation

Users can upgrade to OpenCTI version 6.6.6 or later to address this vulnerability.