Refine your search

6 vulnerabilities found for by yeti-platform

CVE-2026-63500 (GCVE-0-2026-63500)
Vulnerability from cvelistv5
Published
2026-11-03 19:37
Modified
2026-11-03 22:40
Severity ?
7.1 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
CWE
  • CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Summary
Yeti bridges the gap between CTI and DFIR practitioners by providing a Forensics Intelligence platform and pipeline. Prior to 2.5.1, core/schemas/dfiq.py accepts an unvalidated uuid from DFIQ YAML through POST /api/v2/dfiq/from_yaml, and core/web/apiv2/dfiq.py later interpolates that stored value into an archive filesystem path in POST /api/v2/dfiq/to_archive. A low-privileged authenticated user can import a DFIQ object whose UUID contains traversal sequences and trigger archive export, causing attacker-controlled content with a .yaml suffix to be written outside the intended temporary archive directory. The impact is limited by paths writable by the YETI service account, and the separate DFIQ archive-import zip-slip candidate is not part of this vulnerability. This issue is fixed in version 2.5.1.
References
Impacted products
Vendor Product Version
yeti-platform yeti Version: <= 2.5.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-63500",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-03T22:36:07.474697Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-03T22:40:05.658Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "yeti",
          "vendor": "yeti-platform",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= 2.5.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Yeti bridges the gap between CTI and DFIR practitioners by providing a Forensics Intelligence platform and pipeline. Prior to 2.5.1, core/schemas/dfiq.py accepts an unvalidated uuid from DFIQ YAML through POST /api/v2/dfiq/from_yaml, and core/web/apiv2/dfiq.py later interpolates that stored value into an archive filesystem path in POST /api/v2/dfiq/to_archive. A low-privileged authenticated user can import a DFIQ object whose UUID contains traversal sequences and trigger archive export, causing attacker-controlled content with a .yaml suffix to be written outside the intended temporary archive directory. The impact is limited by paths writable by the YETI service account, and the separate DFIQ archive-import zip-slip candidate is not part of this vulnerability. This issue is fixed in version 2.5.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-03T19:37:01.798Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/yeti-platform/yeti/security/advisories/GHSA-6xf2-8436-rgvf",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/yeti-platform/yeti/security/advisories/GHSA-6xf2-8436-rgvf"
        },
        {
          "name": "https://github.com/yeti-platform/yeti/pull/1279",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/yeti-platform/yeti/pull/1279"
        },
        {
          "name": "https://github.com/yeti-platform/yeti/commit/8e36bd0000f98f625540e37eeb9f304c684e8394",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/yeti-platform/yeti/commit/8e36bd0000f98f625540e37eeb9f304c684e8394"
        },
        {
          "name": "https://github.com/yeti-platform/yeti/releases/tag/2.5.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/yeti-platform/yeti/releases/tag/2.5.1"
        }
      ],
      "source": {
        "advisory": "GHSA-6xf2-8436-rgvf",
        "discovery": "UNKNOWN"
      },
      "title": "Yeti: Path traversal in DFIQ uuid allows authenticated arbitrary file write during archive export"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-63500",
    "datePublished": "2026-11-03T19:37:01.798Z",
    "dateReserved": "2026-07-16T21:49:52.069Z",
    "dateUpdated": "2026-11-03T22:40:05.658Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-63502 (GCVE-0-2026-63502)
Vulnerability from cvelistv5
Published
2026-11-03 19:36
Modified
2026-11-03 19:36
Severity ?
8.3 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
CWE
  • CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Summary
Yeti bridges the gap between CTI and DFIR practitioners by providing a Forensics Intelligence platform and pipeline. Prior to 2.5.1, YETI derives ExportTask.file_name from the user-controlled task name and passes it to core/clients/file_storage/classes/local_storage.py without sanitizing traversal sequences or enforcing path confinement. A low-privileged authenticated user using the default local storage backend can call POST /api/v2/tasks/export/new with a traversal name and use ExportTask.file_contents through GET /api/v2/tasks/export/{export_id}/content to read files accessible to the YETI service account. Running ExportTask.run() can also write attacker-controlled export output to an attacker-selected writable path. The impact depends on the service account's filesystem permissions, and universal code execution is not established. This issue is fixed in version 2.5.1.
References
Impacted products
Vendor Product Version
yeti-platform yeti Version: <= 2.5.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "yeti",
          "vendor": "yeti-platform",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= 2.5.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Yeti bridges the gap between CTI and DFIR practitioners by providing a Forensics Intelligence platform and pipeline. Prior to 2.5.1, YETI derives ExportTask.file_name from the user-controlled task name and passes it to core/clients/file_storage/classes/local_storage.py without sanitizing traversal sequences or enforcing path confinement. A low-privileged authenticated user using the default local storage backend can call POST /api/v2/tasks/export/new with a traversal name and use ExportTask.file_contents through GET /api/v2/tasks/export/{export_id}/content to read files accessible to the YETI service account. Running ExportTask.run() can also write attacker-controlled export output to an attacker-selected writable path. The impact depends on the service account\u0027s filesystem permissions, and universal code execution is not established. This issue is fixed in version 2.5.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-03T19:36:06.607Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/yeti-platform/yeti/security/advisories/GHSA-4q3w-w2g5-8wqq",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/yeti-platform/yeti/security/advisories/GHSA-4q3w-w2g5-8wqq"
        },
        {
          "name": "https://github.com/yeti-platform/yeti/pull/1280",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/yeti-platform/yeti/pull/1280"
        },
        {
          "name": "https://github.com/yeti-platform/yeti/commit/bfd7c2424dc05dea2d46b5b106b5071f959d5d5a",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/yeti-platform/yeti/commit/bfd7c2424dc05dea2d46b5b106b5071f959d5d5a"
        },
        {
          "name": "https://github.com/yeti-platform/yeti/releases/tag/2.5.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/yeti-platform/yeti/releases/tag/2.5.1"
        }
      ],
      "source": {
        "advisory": "GHSA-4q3w-w2g5-8wqq",
        "discovery": "UNKNOWN"
      },
      "title": "Yeti: Path traversal in ExportTask name allows authenticated arbitrary file read and write"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-63502",
    "datePublished": "2026-11-03T19:36:06.607Z",
    "dateReserved": "2026-07-16T21:49:52.069Z",
    "dateUpdated": "2026-11-03T19:36:06.607Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-63482 (GCVE-0-2026-63482)
Vulnerability from cvelistv5
Published
2026-11-03 19:35
Modified
2026-11-03 22:40
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE
  • CWE-306 - Missing Authentication for Critical Function
Summary
Yeti bridges the gap between CTI and DFIR practitioners by providing a Forensics Intelligence platform and pipeline. Prior to 2.5.1, YETI registers the audit router without Depends(auth.get_current_active_user), and core/web/apiv2/audit.py does not perform a route-level authentication check for /api/v2/audit/timeline/{id}. An unauthenticated network attacker can use an empty, partial, or specific wildcard path to query TimelineLog records containing the actor, target_id, action, and details fields, including analyst usernames, object identifiers and values, and before-and-after object data. This exposes the operational history of threat-intelligence objects while other application routers require authentication. This issue is fixed in version 2.5.1.
References
Impacted products
Vendor Product Version
yeti-platform yeti Version: < 2.5.1
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-63482",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-03T22:37:08.956502Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-03T22:40:17.683Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "yeti",
          "vendor": "yeti-platform",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.5.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Yeti bridges the gap between CTI and DFIR practitioners by providing a Forensics Intelligence platform and pipeline. Prior to 2.5.1, YETI registers the audit router without Depends(auth.get_current_active_user), and core/web/apiv2/audit.py does not perform a route-level authentication check for /api/v2/audit/timeline/{id}. An unauthenticated network attacker can use an empty, partial, or specific wildcard path to query TimelineLog records containing the actor, target_id, action, and details fields, including analyst usernames, object identifiers and values, and before-and-after object data. This exposes the operational history of threat-intelligence objects while other application routers require authentication. This issue is fixed in version 2.5.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "CWE-306: Missing Authentication for Critical Function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-03T19:35:13.496Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/yeti-platform/yeti/security/advisories/GHSA-34r4-95hx-gxqr",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/yeti-platform/yeti/security/advisories/GHSA-34r4-95hx-gxqr"
        },
        {
          "name": "https://github.com/yeti-platform/yeti/pull/1276",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/yeti-platform/yeti/pull/1276"
        },
        {
          "name": "https://github.com/yeti-platform/yeti/commit/692af02ffc05faabc8638b15a88765cb0e3f2503",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/yeti-platform/yeti/commit/692af02ffc05faabc8638b15a88765cb0e3f2503"
        },
        {
          "name": "https://github.com/yeti-platform/yeti/releases/tag/2.5.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/yeti-platform/yeti/releases/tag/2.5.1"
        }
      ],
      "source": {
        "advisory": "GHSA-34r4-95hx-gxqr",
        "discovery": "UNKNOWN"
      },
      "title": "Yeti: Unauthenticated Access to Full Audit Timeline Discloses All Threat Intelligence Data"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-63482",
    "datePublished": "2026-11-03T19:35:13.496Z",
    "dateReserved": "2026-07-16T21:37:45.769Z",
    "dateUpdated": "2026-11-03T22:40:17.683Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-63489 (GCVE-0-2026-63489)
Vulnerability from cvelistv5
Published
2026-11-03 19:33
Modified
2026-11-03 19:33
Severity ?
7.6 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
CWE
  • CWE-943 - Improper Neutralization of Special Elements in Data Query Logic
Summary
Yeti bridges the gap between CTI and DFIR practitioners by providing a Forensics Intelligence platform and pipeline. In version 2.5.0 and earlier, YETI directly interpolates user-controlled sorting fields and filter_aliases attribute paths into ArangoDB AQL identifier and expression positions in core/database_arango.py. A low-privileged authenticated user can send crafted values to POST /api/v2/observables/search, POST /api/v2/entities/search, POST /api/v2/indicators/search, POST /api/v2/dfiq/search, POST /api/v2/search/, or POST /api/v2/graph/search, causing attacker-controlled AQL subexpressions to be parsed and evaluated. This can provide an error oracle, evaluate expressions against internal collections such as users, alter intended search logic, enumerate schema information, and consume excessive database resources. The verified injection points are read and search contexts, so arbitrary database writes are not established. No fixed version is available as of this review.
References
Impacted products
Vendor Product Version
yeti-platform yeti Version: <= 2.5.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "yeti",
          "vendor": "yeti-platform",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= 2.5.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Yeti bridges the gap between CTI and DFIR practitioners by providing a Forensics Intelligence platform and pipeline. In version 2.5.0 and earlier, YETI directly interpolates user-controlled sorting fields and filter_aliases attribute paths into ArangoDB AQL identifier and expression positions in core/database_arango.py. A low-privileged authenticated user can send crafted values to POST /api/v2/observables/search, POST /api/v2/entities/search, POST /api/v2/indicators/search, POST /api/v2/dfiq/search, POST /api/v2/search/, or POST /api/v2/graph/search, causing attacker-controlled AQL subexpressions to be parsed and evaluated. This can provide an error oracle, evaluate expressions against internal collections such as users, alter intended search logic, enumerate schema information, and consume excessive database resources. The verified injection points are read and search contexts, so arbitrary database writes are not established. No fixed version is available as of this review."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-943",
              "description": "CWE-943: Improper Neutralization of Special Elements in Data Query Logic",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-03T19:33:57.975Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/yeti-platform/yeti/security/advisories/GHSA-vw33-fwfx-6m9p",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/yeti-platform/yeti/security/advisories/GHSA-vw33-fwfx-6m9p"
        },
        {
          "name": "https://github.com/yeti-platform/yeti/pull/1277",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/yeti-platform/yeti/pull/1277"
        },
        {
          "name": "https://github.com/yeti-platform/yeti/commit/89d8b61cf97b0fb2d46c2f9ee8b7411444345fc6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/yeti-platform/yeti/commit/89d8b61cf97b0fb2d46c2f9ee8b7411444345fc6"
        },
        {
          "name": "https://github.com/yeti-platform/yeti/releases/tag/2.5.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/yeti-platform/yeti/releases/tag/2.5.1"
        }
      ],
      "source": {
        "advisory": "GHSA-vw33-fwfx-6m9p",
        "discovery": "UNKNOWN"
      },
      "title": "Yeti: Authenticated AQL injection via unvalidated search sorting and filter_aliases parameters"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-63489",
    "datePublished": "2026-11-03T19:33:57.975Z",
    "dateReserved": "2026-07-16T21:49:52.068Z",
    "dateUpdated": "2026-11-03T19:33:57.975Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-92783 (GCVE-0-2026-92783)
Vulnerability from cvelistv5
Published
2026-09-16 20:32
Modified
2026-09-17 13:48
Severity ?
7.2 (High) - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
8.1 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
CWE
Summary
Yeti through 2.11.0 fails to validate caller permissions in the DELETE /api/v2/rbac/{id} endpoint, allowing users with read access to delete access control relationships. Attackers can revoke the owner's grant and permanently lock legitimate owners out of objects.
References
Impacted products
Vendor Product Version
yeti-platform yeti Version: 0   ≤ 2.11.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-92783",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-17T13:48:32.597739Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-17T13:48:45.094Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "yeti",
          "vendor": "yeti-platform",
          "versions": [
            {
              "lessThanOrEqual": "2.11.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:yeti-platform:yeti:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "2.11.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "George Chen"
        }
      ],
      "datePublic": "2026-08-26T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Yeti through 2.11.0 fails to validate caller permissions in the DELETE /api/v2/rbac/{id} endpoint, allowing users with read access to delete access control relationships. Attackers can revoke the owner\u0027s grant and permanently lock legitimate owners out of objects."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-16T20:32:40.330Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Issue #1349",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/yeti-platform/yeti/issues/1349"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/yeti-platform/yeti"
        },
        {
          "name": "the delete handler performs no permission check",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/yeti-platform/yeti/blob/2.5.1/core/web/apiv2/rbac.py#L110-L116"
        },
        {
          "name": "sibling handlers require Role.OWNER",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/yeti-platform/yeti/blob/2.5.1/core/web/apiv2/rbac.py#L52-L53"
        },
        {
          "name": "VulnCheck Advisory: Yeti through 2.11.0 Missing Authorization on RBAC Relationship Deletion",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/yeti-through-2.11.0-missing-authorization-on-rbac-relationship-deletion"
        }
      ],
      "title": "Yeti through 2.11.0 Missing Authorization on RBAC Relationship Deletion",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-92783",
    "datePublished": "2026-09-16T20:32:40.330Z",
    "dateReserved": "2026-09-16T19:22:54.542Z",
    "dateUpdated": "2026-09-17T13:48:45.094Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-45412 (GCVE-0-2024-45412)
Vulnerability from cvelistv5
Published
2024-09-10 15:19
Modified
2024-09-10 16:09
Severity ?
5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CWE
  • CWE-770 - Allocation of Resources Without Limits or Throttling
Summary
Yeti bridges the gap between CTI and DFIR practitioners by providing a Forensics Intelligence platform and pipeline. Remote user-controlled data tags can reach a Unicode normalization with a compatibility form NFKD. Under Windows, such normalization is costly in resources and may lead to denial of service with attacks such as One Million Unicode payload. This can get worse with the use of special Unicode characters like U+2100 (℀), or U+2105 (℅) which could lead the payload size to be tripled. Versions prior to 2.1.11 are affected by this vulnerability. The patch is included in 2.1.11.
References
Impacted products
Vendor Product Version
yeti-platform yeti Version: < 2.1.11
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-45412",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T16:08:22.286343Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-10T16:09:40.822Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "yeti",
          "vendor": "yeti-platform",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.1.11"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Yeti bridges the gap between CTI and DFIR practitioners by providing a Forensics Intelligence platform and pipeline. Remote user-controlled data tags can reach a Unicode normalization with a compatibility form NFKD. Under Windows, such normalization is costly in resources and may lead to denial of service with attacks such as One Million Unicode payload. This can get worse with the use of special Unicode characters like U+2100 (\u2100), or U+2105 (\u2105) which could lead the payload size to be tripled. Versions prior to 2.1.11 are affected by this vulnerability. The patch is included in 2.1.11."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-10T15:19:40.623Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/yeti-platform/yeti/security/advisories/GHSA-cwwm-pq9x-2cxv",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/yeti-platform/yeti/security/advisories/GHSA-cwwm-pq9x-2cxv"
        },
        {
          "name": "https://github.com/yeti-platform/yeti/commit/f1f0082e7c165f148ae95f4deeb2786404797a39",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/yeti-platform/yeti/commit/f1f0082e7c165f148ae95f4deeb2786404797a39"
        },
        {
          "name": "https://hackerone.com/reports/2258758",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://hackerone.com/reports/2258758"
        }
      ],
      "source": {
        "advisory": "GHSA-cwwm-pq9x-2cxv",
        "discovery": "UNKNOWN"
      },
      "title": "Yeti affected by a Potential Denial of Service due to the One Milion Unicode characters attack"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-45412",
    "datePublished": "2024-09-10T15:19:40.623Z",
    "dateReserved": "2024-08-28T20:21:32.805Z",
    "dateUpdated": "2024-09-10T16:09:40.822Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}