CVE-2026-92783
Gravedad CVSS v4.0:
ALTA
Tipo:
No Disponible / Otro tipo
Fecha de publicación:
16/09/2026
Última modificación:
23/09/2026
Descripción
*** Pendiente de traducción *** Yeti through 2.11.0 fails to validate caller permissions in the DELETE /api/v2/rbac/{id} endpoint, allowing users with read access to delete access control relationships. Attackers can revoke the owner's grant and permanently lock legitimate owners out of objects.
Impacto
Puntuación base 4.0
7.20
Gravedad 4.0
ALTA
Puntuación base 3.x
8.10
Gravedad 3.x
ALTA
Referencias a soluciones, herramientas e información
- https://github.com/yeti-platform/yeti
- https://github.com/yeti-platform/yeti/blob/2.5.1/core/web/apiv2/rbac.py#L110-L116
- https://github.com/yeti-platform/yeti/blob/2.5.1/core/web/apiv2/rbac.py#L52-L53
- https://github.com/yeti-platform/yeti/issues/1349
- https://www.vulncheck.com/advisories/yeti-through-2.11.0-missing-authorization-on-rbac-relationship-deletion