CVE-2026-92783

Overview

Yeti versions up to and including 2.11.0 contain an authorization bypass vulnerability in the RBAC API endpoint. The DELETE /api/v2/rbac/{id} endpoint fails to properly validate caller permissions, allowing users with read-only access to delete access control relationships. This issue permits low-privileged users to revoke ownership grants and lock legitimate users out of objects.

Description

Yeti through 2.11.0 fails to validate caller permissions in the DELETE /api/v2/rbac/{id} endpoint, allowing users with read access to delete access control relationships. Attackers can revoke the owner's grant and permanently lock legitimate owners out of objects.

Impact

Impacts organizations deploying affected versions of the Yeti platform. Exploitation primarily affects Integrity and Availability by allowing low-privileged authenticated users to alter access control records and cause denial-of-service conditions for object owners.

Remediation

Update Yeti to a version newer than 2.11.0 where proper caller permission checks are implemented for the RBAC API. As an immediate mitigation, audit user privileges to restrict read access to API endpoints and monitor logs for unexpected DELETE requests to /api/v2/rbac/.

Risk context

Assessed with a High severity rating (CVSS v3 8.1, CVSS v4 7.2). The vulnerability poses a notable operational risk as it enables low-privilege users to disrupt administration and access management workflows.

Affected products

• Yeti Yeti <= 2.11.0