Einfachanders

**Name of the Vulnerable Software and Affected Versions** OpenCTI versions prior to 6.6.6 **Description** OpenCTI is a platform for managing cyber threat intelligence knowledge and observables. An IDOR vulnerability exists in the GraphQL `NotificationLineNotificationMarkReadMutation` and `NotificationLineNotificationDeleteMutation` mutations. This allows an authenticated user to modify the read status or delete notifications belonging to other users if they know the UUID of the notification. When changing the read status, the user also receives the content of the notification. **Recommendations** Update to version 6.6.6 or later.