Is CVE-2026-92783 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-92783 being exploited in the wild.

How severe is CVE-2026-92783?

High severity, with a CVSS score of 8.1, published 16 September 2026.

Is there a fix for CVE-2026-92783?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-92783 attacked?

It is attacked over the network.

Am I affected by CVE-2026-92783?

Check whether you run Yeti at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-92783: Yeti authorization bypass in DELETE /api/v2/rbac/{id}

CVE-2026-92783 · Severity: high · CVSS 8.1 · Published 2026-09-16

Yeti is a threat intelligence platform used by security teams to manage and correlate indicators of compromise and forensic data. A flaw in access control validation allows users with read-only permissions to delete access control rules, potentially locking legitimate administrators out of critical objects and disrupting security operations.

Technologies: Yeti. Vendors: Yeti.

Quick answers

Is CVE-2026-92783 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-92783 being exploited in the wild.
How severe is CVE-2026-92783?: High severity, with a CVSS score of 8.1, published 16 September 2026.
Which products and versions are affected?: Yeti through 2.11.0.
Is there a fix for CVE-2026-92783?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-92783 attacked?: It is attacked over the network.
Am I affected by CVE-2026-92783?: Check whether you run Yeti at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The DELETE /api/v2/rbac/{id} endpoint in Yeti through version 2.11.0 fails to properly validate caller permissions before allowing deletion of RBAC (role-based access control) relationships. The vulnerable code does not enforce OWNER-level permissions on the target object before processing the DELETE request, allowing authenticated users with only READER permissions to revoke access grants. An authenticated attacker can exploit this by crafting DELETE requests to remove the owner's grant on an object, permanently denying legitimate owners access. The fix requires adding explicit OWNER-level permission checks similar to those present in other endpoints like POST /update-members.

Affected products

Yeti Yeti through 2.11.0

Timeline

2026-09-16: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.