CVE-2026-92783

EUVD-2026-81046
Yeti through 2.11.0 fails to validate caller permissions in the DELETE /api/v2/rbac/{id} endpoint, allowing users with read access to delete access control relationships. Attackers can revoke the owner's grant and permanently lock legitimate owners out of objects.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.1 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Common Weakness Enumeration
References
https://github.com/yeti-platform/yeti
https://github.com/yeti-platform/yeti/blob/2.5.1/core/web/apiv2/rbac.py#L110-L116
https://github.com/yeti-platform/yeti/blob/2.5.1/core/web/apiv2/rbac.py#L52-L53
https://github.com/yeti-platform/yeti/issues/1349
https://www.vulncheck.com/advisories/yeti-through-2.11.0-missing-authorization-on-rbac-relationship-deletion