Aql-Injection - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/aql-injection/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 03 Nov 2026 22:19:59 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgYETI: Authentication bypass in audit router (CVE-2026-63482)https://feed.craftedsignal.io/briefs/2026-11-yeti-auth-bypass/Tue, 03 Nov 2026 22:19:59 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-yeti-auth-bypass/The YETI Forensics Intelligence platform prior to version 2.5.1 contains an authentication bypass vulnerability allowing unauthenticated attackers to retrieve sensitive audit logs via the API.YETI versions prior to 2.5.1 contain an authentication bypass vulnerability in the audit router. The file core/web/apiv2/audit.py fails to implement the required auth.get_current_active_user dependency for the /api/v2/audit/timeline/{id} endpoint. An unauthenticated attacker can exploit this to query sensitive TimelineLog records, which contain analyst usernames, object identifiers, and historical threat intelligence object data.

Impact

Unauthorized exposure of operational threat intelligence, including analyst identity and sensitive object modification history.

Recommendation

Upgrade the YETI platform to version 2.5.1 or later to apply the missing route-level authentication checks.

Hunt Leads

  • Lead: Audit access to the /api/v2/audit/timeline/ endpoint data_needed:
  • Web server access logs or application-level API request logs priority: "high" confidence: "high" disposition: "hunt_now" evidence: "An unauthenticated network attacker can use an empty, partial, or specific wildcard path to query TimelineLog records containing the actor, target_id, action, and details fields."
]]>highadvisoryaql-injectionweb-application-vulnerabilityinjectioncve-2026-63489