CVE-2026-63482 Details

A vulnerability in Yeti prior to version 2.5.1 allows unauthenticated network attackers to access the full audit timeline of all objects within a Yeti instance. The issue arises because the audit router is registered without authentication dependencies, leaving the `/api/v2/audit/timeline/{id}` endpoint open for exploitation. This endpoint can be queried with empty, partial, or specific wildcard paths to retrieve TimelineLog records that include sensitive information such as actor details, object identifiers, and the complete history of actions performed on threat intelligence objects. This vulnerability exposes critical operational data without requiring any form of user authentication or authorization.

Users can upgrade to Yeti version 2.5.1, where this vulnerability has been addressed by adding the necessary authentication checks to the audit router.