CVE-2026-92783: Yeti through 2.11.0 Missing Authorization on RBAC Relationship Deletion

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-16 · updated 2026-09-23
Weakness: CWE-862

Description

Yeti through 2.11.0 fails to validate caller permissions in the DELETE /api/v2/rbac/{id} endpoint, allowing users with read access to delete access control relationships. Attackers can revoke the owner's grant and permanently lock legitimate owners out of objects.

Affected products

yeti-platform yeti: through 2.11.0

References

https://github.com/yeti-platform/yeti
https://github.com/yeti-platform/yeti/blob/2.5.1/core/web/apiv2/rbac.py#L110-L116
https://github.com/yeti-platform/yeti/blob/2.5.1/core/web/apiv2/rbac.py#L52-L53
https://github.com/yeti-platform/yeti/issues/1349
https://www.vulncheck.com/advisories/yeti-through-2.11.0-missing-authorization-on-rbac-relationship-deletion

Get alerted when CVE-2026-92783 or the next vulnerability affects your stack