Executive brief
Yeti is a threat intelligence platform used by security teams to manage and correlate indicators of compromise and forensic data. A flaw in access control validation allows users with read-only permissions to delete access control rules, potentially locking legitimate administrators out of critical objects and disrupting security operations.
Technical details
The DELETE /api/v2/rbac/{id} endpoint in Yeti through version 2.11.0 fails to properly validate caller permissions before allowing deletion of RBAC (role-based access control) relationships. The vulnerable code does not enforce OWNER-level permissions on the target object before processing the DELETE request, allowing authenticated users with only READER permissions to revoke access grants. An authenticated attacker can exploit this by crafting DELETE requests to remove the owner's grant on an object, permanently denying legitimate owners access. The fix requires adding explicit OWNER-level permission checks similar to those present in other endpoints like POST /update-members.
Affected products
- Yeti Yeti through 2.11.0
Timeline
- 2026-09-16: disclosed