Broken Object Level Authorization (BOLA) on Draft Workspaces in OpenCTI

Alopsis — 2026-08-26

1. Summary OpenCTI, an open source cyber threat intelligence platform, was found to contain a Broken Object Level Authorization (BOLA) vulnerability (CVE-2026-121708) in the way it manages Draft Workspaces. Drafts are meant to be private to their creator. However, any authenticated user could enumerate the drafts of other users, read their contents, and inject data into them. This issue affects versions prior to 7.260513.0 and has since been addressed and fixed through a security patch: - https://github.com/OpenCTI-Platform/opencti/security/advisories/GHSA-8jgr-3543-vfvv -…