Removing Sharing Organization removes relationships

[ristowee]

Description

There's something weird going on when streaming data with a user that has an organization attached to it (let's say OrgX in this case) and there's data that has has been shared with OrgX.

A relationship link between two things disappears in a certain condition. It cannot be found with the internal / standard ids after it has disappeared.

Environment

1. OS (where OpenCTI server runs): Debian 10 (docker)
2. OpenCTI version: 5.9.6
3. OpenCTI client: frontend
4. Other environment details:

Reproducible Steps

1. Create an organization OrgX
2. Add a user with streaming capabilities and add it to OrgX
3. Create an observable, indicator and a relation (easiest to add e.g. a domain-name and then enable "Create an indicator from this observable")
4. Share all 3 to OrgX ("Share with an organization" button). You should see all 3 in the stream now.
5. Remove sharing to OrgX from the indicator. After this point the relationship should still exist.
6. Stream the data using the abovementioned user.
7. After this the relationship has disappeared from the system

Expected Output

Removing the sharing should not delete the relationship between the two objects.

Actual Output

The relationship has been removed. It cannot be found in the system with the internal ID or standard ID.

Additional information

Streaming at step 6. as an admin or another user, which has not OrgX affiliations does not have the effect and the relationship remains.

I tried searching the history index for deletions but it shows just some old stuff.

Screenshots (optional)

[ristowee]

Some clarifications:
I tested streaming with a browser to see the results easier–there wasn't another instance reading the data.
The relationship data had disappeared from the ElasticSearch (made queries with the id / standard_id)

[ristowee]

With the "stream" in meant a "synchronization stream".
I did a test by running a live stream started as admin and I can see no deletion there regarding the relationship when this thing happens. I was able to see the other steps there.