Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-63482— Yeti: Unauthenticated Access to Full Audit Timeline Discloses All Threat Intelligence Data

Quick assessment

Affected

yeti-platform yeti

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Yeti 通过提供取证情报平台与数据管道，弥合了威胁情报（CTI）与数字取证及事件响应（DFIR）从业者之间的鸿沟。在 2.5.1 版本之前，YETI 在注册审计路由时未添加依赖，且未对接口执行路由级别的身份验证检查。未认证的远程网络攻击者可利用空路径、部分路径或特定通配符路径，查询包含（操作者）、（目标标识）、（动作）及（详情）字段的 TimelineLog 记录。这些记录中可能包含分析师用户名、对象标识符与值，以及对象变更前后的数据。该漏洞暴露了威胁情报对象的操作历史，而应用中其他路由均要求身份验

CVSS 7.5 · High Updated Nov 04, 2026

Possible ATT&CK Techniques 2 AI

T1040 · Network Sniffing T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

Vendor	Product	Version Range	Status
yeti-platform	yeti	`< 2.5.1`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Yeti: Unauthenticated Access to Full Audit Timeline Discloses All Threat Intelligence Data

Source: CVE Program / CVE List V5

Vulnerability Description

Yeti bridges the gap between CTI and DFIR practitioners by providing a Forensics Intelligence platform and pipeline. Prior to 2.5.1, YETI registers the audit router without Depends(auth.get_current_active_user), and core/web/apiv2/audit.py does not perform a route-level authentication check for /api/v2/audit/timeline/{id}. An unauthenticated network attacker can use an empty, partial, or specific wildcard path to query TimelineLog records containing the actor, target_id, action, and details fields, including analyst usernames, object identifiers and values, and before-and-after object data. This exposes the operational history of threat-intelligence objects while other application routers require authentication. This issue is fixed in version 2.5.1.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

关键功能的认证机制缺失

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
yeti-platform	yeti	< 2.5.1	-

II. Public POCs for CVE-2026-63482

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-63482

请登录查看更多情报信息。

Other References for CVE-2026-63482 (4)

https://github.com/yeti-platform/yeti/pull/1276 x_refsource_MISC
https://github.com/yeti-platform/yeti/releases/tag/2.5.1 x_refsource_MISC
https://github.com/yeti-platform/yeti/security/advisories/GHSA-34r4-95hx-gxqr x_refsource_CONFIRM
https://github.com/yeti-platform/yeti/commit/692af02ffc05faabc8638b15a88765cb0e3f2503 x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-63482

Same Patch Batch · yeti-platform · 2026-11-03 · 4 CVEs total

CVE-2026-63502	8.3 HIGH	Yeti: Path traversal in ExportTask name allows authenticated arbitrary file read and write
CVE-2026-63489	7.6 HIGH	Yeti: Authenticated AQL injection via unvalidated search sorting and filter_aliases parame
CVE-2026-63500	7.1 HIGH	Yeti: Path traversal in DFIQ uuid allows authenticated arbitrary file write during archive

IV. Related Vulnerabilities

Same product: yeti

Same vendor: yeti-platform

Same weakness: CWE-306