CVE-2025-24887: OpenCTI bypass of protected attribute update
OpenCTI is an open-source cyber threat intelligence platform. In versions starting from 6.4.8 to before 6.4.10, the allow/deny lists can be bypassed, allowing a user to change attributes that are intended to be unmodifiable by the user. It is possible to toggle the external flag on/off and change the own token value for a user. It is also possible to edit attributes that are not in the allow list, such as otpqr and otpactivated. If external users exist in the OpenCTI setup and the information about these users identities is sensitive, the above vulnerabilities can be used to enumerate existing user accounts as a standard low privileged user. This issue has been patched in version 6.4.10.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-24887?
CVE-2025-24887 has been classified as a moderate severity vulnerability.
How do I fix CVE-2025-24887?
To fix CVE-2025-24887, upgrade OpenCTI to version 6.4.10 or later.
What versions of OpenCTI are affected by CVE-2025-24887?
OpenCTI versions from 6.4.8 to before 6.4.10 are affected by CVE-2025-24887.
What does the CVE-2025-24887 vulnerability allow an attacker to do?
CVE-2025-24887 allows a user to bypass allow/deny lists and modify attributes that should be unmodifiable.
Is there any known exploit for CVE-2025-24887?
As of now, there are no publicly disclosed exploits specifically targeting CVE-2025-24887.