CVE-2026-92783highCWE-862

CVE-2026-92783: falha de alta gravidade em yeti-platform yeti

Yeti through 2.11.0 Missing Authorization on RBAC Relationship Deletion

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar yeti

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.2epss 0.5%
Yeti through 2.11.0 fails to validate caller permissions in the DELETE /api/v2/rbac/{id} endpoint, allowing users with read access to delete access control relationships. Attackers can revoke the owner's grant and permanently lock legitimate owners out of objects.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
yeti-platform · yeti
CVEs relacionadas — yeti-platform yeti

No mesmo produto, das mais perigosas para as menos.

CVE-2024-45412MEDIUMYeti affected by a Potential Denial of Service due to the One Milion Unicode characters attackEPSS 0.8%CVE-2026-63482HIGHYeti: Unauthenticated Access to Full Audit Timeline Discloses All Threat Intelligence DataEPSS 0.4%CVE-2026-63502HIGHYeti: Path traversal in ExportTask name allows authenticated arbitrary file read and writeEPSS 0.4%CVE-2026-63500HIGHYeti: Path traversal in DFIQ uuid allows authenticated arbitrary file write during archive exportEPSS 0.4%CVE-2026-63489HIGHYeti: Authenticated AQL injection via unvalidated search sorting and filter_aliases parametersEPSS 0.3%