CVE-2026-92783 Details

A vulnerability exists in Yeti versions through 2.11.0, where the DELETE /api/v2/rbac/{id} endpoint lacks proper authorization checks. This flaw enables users with only read access to delete access control relationships, effectively revoking ownership rights and locking legitimate owners out of their objects. The issue arises because the endpoint does not require verification of permissions before allowing deletions, contrary to similar endpoints that enforce ownership checks.

The Yeti development team should be notified to implement a fix. The suggested remediation is to modify the delete() function in the rbac.py file to require ownership permissions on the target object before allowing deletion, similar to the existing update_member endpoint.