CyberRota Analysis
AI-GeneratedThe vulnerability allows users with only read access to delete access control relationships via the DELETE /api/v2/rbac/{id} endpoint in Yeti versions up to 2.11.0, compromising the integrity of access controls. This could enable attackers to revoke permissions from legitimate owners, effectively locking them out of their own resources. Organizations using affected versions should prioritize remediation to prevent unauthorized access manipulation and potential data loss.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Yeti through 2.11.0 fails to validate caller permissions in the DELETE /api/v2/rbac/{id} endpoint, allowing users with read access to delete access control relationships. Attackers can revoke the owner's grant and permanently lock legitimate owners out of objects.