CVE-2026-92783: Yeti-Platform Yeti

High severity, CVSS 8.1. EPSS: 0.5% chance of exploitation in the next 30 days.

Yeti through 2.11.0 fails to validate caller permissions in the DELETE /api/v2/rbac/{id} endpoint, allowing users with read access to delete access control relationships. Attackers can revoke the owner's grant and permanently lock legitimate owners out of objects.

Affected products

• Yeti-Platform Yeti: up to and including 2.11.0

Published 2026-09-16. Last modified 2026-09-23.