Unauthorized Access Control Vulnerability in Yeti by Yeti Platform

CVE-2026-92783

What is CVE-2026-92783?

The Yeti API, up to version 2.11.0, contains a critical design flaw that fails to appropriately validate caller permissions for the DELETE /api/v2/rbac/{id} endpoint. This oversight permits users with merely read access to delete access control relationships, which could enable malicious actors to revoke access privileges from legitimate owners, effectively locking them out of their own resources. This vulnerability not only jeopardizes the security of the application's access management but also poses a significant risk of unauthorized changes within organizational RBAC configurations.

References