Skip to content
Threat Feed
Subscribe

Product

Yeti (<= 2.11.0)

1 brief RSS
high advisory

Authorization Bypass in Yeti RBAC API

Yeti versions 2.11.0 and earlier contain an authorization vulnerability in the DELETE /api/v2/rbac/{id} endpoint that allows unauthorized users to delete access control relationships, causing permanent lockout of legitimate object owners.

Yeti
1r 1t 1c