CVE-2026-92783

Name of the Vulnerable Software and Affected Versions Yeti versions prior to 2.11.1

Description Insufficient validation of caller permissions in the 'DELETE /api/v2/rbac/{id}' endpoint allows users with read access to delete access control relationships. This can enable attackers to revoke the owner's grant, resulting in legitimate owners being permanently locked out of objects.

Recommendations Update to version 2.11.1 or later. As a temporary workaround, restrict access to the 'DELETE /api/v2/rbac/{id}' endpoint.