CVE-2026-63482

Name of the Vulnerable Software and Affected Versions Yeti versions prior to 2.5.1

Description The application fails to implement a route-level authentication check in the audit router. Specifically, the endpoint '/api/v2/audit/timeline/{id}' does not require the auth.get current active user dependency. This allows an unauthenticated network attacker to use empty, partial, or wildcard paths to query TimelineLog records. Exposed data includes the actor, target id, action, and details fields, which may contain analyst usernames, object identifiers, and historical data of threat-intelligence objects.

Recommendations Update to version 2.5.1.