Authorization Bypass in Yeti RBAC API

Yeti versions up to and including 2.11.0 contain a critical authorization vulnerability (CVE-2026-92783) within the RBAC API management subsystem. The vulnerability resides in the DELETE /api/v2/rbac/{id} endpoint, which lacks sufficient server-side permission validation. This flaw allows an authenticated attacker possessing only read-only access to successfully invoke the deletion of access control entries for objects they do not own. By exploiting this oversight, an attacker can revoke administrative grants or ownership associations, resulting in a persistent state where legitimate owners are permanently locked out of their objects and denied administrative control. This represents a significant integrity and availability risk for environments utilizing Yeti for access management.

Impact

Successful exploitation results in unauthorized modification of security policies and permanent denial of service for administrative object management. In multi-tenant or collaborative environments, an attacker with low-privileged read access can effectively neutralize security controls, prevent legitimate administrators from accessing critical data, and disrupt organizational workflows.

Recommendation

Prioritize the immediate update of all Yeti instances to a patched version beyond 2.11.0. If immediate patching is not feasible, restrict access to the /api/v2/rbac/ endpoint using a web application firewall or reverse proxy to block DELETE methods from unauthorized accounts.