{"id":"CVE-2026-63482","kind":"vulnerability","aliases":["CVE-2026-63482"],"related":[],"title":"Yeti: unauthenticated audit timeline endpoint leaks analyst activity records","description":"Yeti bridges the gap between CTI and DFIR practitioners by providing a Forensics Intelligence platform and pipeline. Prior to 2.5.1, YETI registers the audit router without Depends(auth.get_current_active_user), and core/web/apiv2/audit.py does not perform a route-level authentication check for /api/v2/audit/timeline/{id}. An unauthenticated network attacker can use an empty, partial, or specific wildcard path to query TimelineLog records containing the actor, target_id, action, and details fields, including analyst usernames, object identifiers and values, and before-and-after object data. This exposes the operational history of threat-intelligence objects while other application routers require authentication. This issue is fixed in version 2.5.1.","summary":"Yeti is a threat-intelligence and forensics platform. Before version 2.5.1, its audit timeline API at /api/v2/audit/timeline/ was registered without an authentication check, so an unauthenticated network attacker can read audit records with analyst usernames, object identifiers and before-and-after object data.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dfir","package","self-hosted","threat-intelligence","yeti"],"not_affected_if":["not-network-reachable","version-2.5.1-or-later"],"how_to_check":"- Check the installed Yeti version against `2.5.1`.\n- Look for the audit router registration in `core/web/apiv2/audit.py` and confirm it lacks `Depends(auth.get_current_active_user)`.\n- Request `/api/v2/audit/timeline/` without credentials and confirm whether it returns data.","fix":"- Upgrade Yeti to `2.5.1`.","status":"open","published_at":"2026-11-03T20:18:16+00:00","first_seen_at":"2026-11-03T20:49:23+00:00","triaged_at":"2026-11-03T20:50:13+00:00","updated_at":"2026-11-03T20:50:13+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-03T20:50:13Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Yeti to `2.5.1`.","reach":"network","title":"Yeti: unauthenticated audit timeline endpoint leaks analyst activity records","impact":"medium","summary":"Yeti is a threat-intelligence and forensics platform. Before version 2.5.1, its audit timeline API at /api/v2/audit/timeline/ was registered without an authentication check, so an unauthenticated network attacker can read audit records with analyst usernames, object identifiers and before-and-after object data.","audience":"businesses","category":"package","nicknames":[],"who_cares":["yeti","self-hosted","threat-intelligence","dfir"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Unauthenticated attackers read analyst usernames and threat-intel object history","analyst_note":"","how_to_check":"- Check the installed Yeti version against `2.5.1`.\n- Look for the audit router registration in `core/web/apiv2/audit.py` and confirm it lacks `Depends(auth.get_current_active_user)`.\n- Request `/api/v2/audit/timeline/` without credentials and confirm whether it returns data.","plain_action":"","needs_analyst":false,"not_affected_if":["version-2.5.1-or-later","not-network-reachable"],"who_is_affected":"Teams running a self-hosted Yeti instance reachable over the network before version 2.5.1 are exposed, since the audit timeline route skips the authentication that other Yeti routers enforce. Instances restricted to a trusted internal network or not reachable from others carry less risk, but the sources do not say how many deployments are internet-facing.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000738,"input_tokens":4319,"output_tokens":612,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-63482':12A,15A '/api/v2/audit/timeline':42B,113C '2.5.1':36B,89C,177C 'action':137C 'activ':8A,99C 'actor':134C 'analyst':7A,59B,142C 'api':40B 'applic':167C 'attack':53B,118C 'audit':3A,38B,56B,93C 'auth.get':97C 'authent':47B,110C,170C 'before-and-aft':64B,149C 'bridg':71C 'check':48B,111C 'contain':132C 'core/web/apiv2/audit.py':102C 'cti':75C 'current':98C 'cve':10A,13A 'data':69B,154C 'depend':96C 'detail':139C 'dfir':16B,77C 'empti':122C 'endpoint':5A 'expos':156C 'field':140C 'fix':174C 'forens':32B,82C 'gap':73C 'histori':159C 'host':20B 'id':114C,136C 'identifi':62B,145C 'includ':141C 'intellig':23B,30B,83C,163C 'issu':172C 'leak':6A 'level':109C 'network':52B,117C 'object':61B,68B,144C,153C,164C 'oper':158C 'packag':17B 'partial':123C 'path':127C 'perform':105C 'pipelin':86C 'platform':33B,84C 'practition':78C 'prior':87C 'provid':80C 'queri':129C 'read':55B 'record':9A,57B,131C 'regist':44B,91C 'requir':169C 'rout':108C 'route-level':107C 'router':94C,168C 'self':19B 'self-host':18B 'specif':125C 'target':135C 'threat':22B,29B,162C 'threat-intellig':21B,28B,161C 'timelin':4A,39B 'timelinelog':130C 'unauthent':2A,51B,116C 'use':120C 'user':100C 'usernam':60B,143C 'valu':147C 'version':35B,176C 'wildcard':126C 'without':45B,95C 'yeti':1A,24B,25B,70C,90C","nicknames":[],"mitigations":[],"who_affected":"Teams running a self-hosted Yeti instance reachable over the network before version 2.5.1 are exposed, since the audit timeline route skips the authentication that other Yeti routers enforce. Instances restricted to a trusted internal network or not reachable from others carry less risk, but the sources do not say how many deployments are internet-facing.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["dfir","high","package","selfhosted","threatintelligence","yeti"],"campaign_type":null,"first_public_at":"2026-07-01T12:04:40+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-63482","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63482","severity":null,"published_at":"2026-11-03T20:18:16+00:00","modified_at":"2026-11-03T20:18:16+00:00","first_seen_at":"2026-11-03T20:49:23+00:00","fetched_at":"2026-11-03T20:49:23+00:00","note":null}],"documents":[{"id":60607,"url":"https://github.com/yeti-platform/yeti/commit/692af02ffc05faabc8638b15a88765cb0e3f2503","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":60608,"url":"https://github.com/yeti-platform/yeti/releases/tag/2.5.1","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":60609,"url":"https://github.com/yeti-platform/yeti/security/advisories/GHSA-34r4-95hx-gxqr","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-01T12:04:40+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}