{
  "entrypoint_kind": "endpoint",
  "entrypoint_detail": "POST /graphql on opencti/platform (vuln 6.9.12, fixed 6.9.13) with Authorization: Bearer hardcoded admin internal_id",
  "service_started": true,
  "healthcheck_passed": true,
  "target_path_reached": true,
  "runtime_stack": [
    "opencti/platform (Node.js GraphQL API)",
    "elasticsearch",
    "redis",
    "rabbitmq",
    "minio"
  ],
  "proof_artifacts": [
    "logs/reproduction_steps.log",
    "artifacts/opencti/vuln_attack_me_response.json",
    "artifacts/opencti/vuln_attack_users_response.json",
    "artifacts/opencti/vuln_control_noauth_response.json",
    "artifacts/opencti/vuln_control_random_uuid_response.json",
    "artifacts/opencti/vuln_control_valid_token_response.json",
    "artifacts/opencti/fixed_attack_me_response.json",
    "artifacts/opencti/fixed_control_valid_token_response.json",
    "artifacts/opencti/platform_vuln.log",
    "artifacts/opencti/platform_fixed.log"
  ],
  "notes": "Unauthenticated GraphQL request bearing only the hardcoded OPENCTI_ADMIN_UUID authenticated as default admin on 6.9.12 and was rejected on 6.9.13; valid api_token accepted on both."
}