CVE-2026-92783: Yeti through 2.11.0 Missing Authorization on RBAC Relationship Deletion
Published Sep 16, 2026
·Updated
Yeti through 2.11.0 fails to validate caller permissions in the DELETE /api/v2/rbac/{id} endpoint, allowing users with read access to delete access control relationships. Attackers can revoke the owner's grant and permanently lock legitimate owners out of objects.
Affected Software
1 affected component
Yeti<=2.11.0
Event History
Sep 16, 2026
CVE Published
via MITRE·08:32 PM
Data Sourced
via MITRE·08:32 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Does exploitation require administrative privileges or user interaction?
No. The CVSS vector indicates low privileges and no user interaction, and the issue allows users with read access to delete RBAC relationships.
2
Can this be exploited remotely?
Yes. The attack vector is network-based and has low attack complexity.
3
What security impact is indicated beyond access-control changes?
The reported impact is high for integrity and availability, with no confidentiality impact indicated. Deleting an owner's grant can permanently prevent legitimate owners from accessing objects.