CVE-2026-63482
Deferred Deferred - Pending Action

Yeti Forensics Platform Unauthenticated TimelineLog Data Exposure

Publication date: 2026-11-03

Last updated on: 2026-11-03

Assigner: GitHub, Inc.

Description
Yeti bridges the gap between CTI and DFIR practitioners by providing a Forensics Intelligence platform and pipeline. Prior to 2.5.1, YETI registers the audit router without Depends(auth.get_current_active_user), and core/web/apiv2/audit.py does not perform a route-level authentication check for /api/v2/audit/timeline/{id}. An unauthenticated network attacker can use an empty, partial, or specific wildcard path to query TimelineLog records containing the actor, target_id, action, and details fields, including analyst usernames, object identifiers and values, and before-and-after object data. This exposes the operational history of threat-intelligence objects while other application routers require authentication. This issue is fixed in version 2.5.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-03
Last Modified
2026-11-03
Generated
2026-11-03
AI Q&A
2026-11-03
EPSS Evaluated
N/A
NVD
CVE-2026-63482
EUVD
EUVD-2026-116264

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
yeti-platform yeti < 2.5.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Yeti is a Forensics Intelligence platform that had a security flaw in versions before 2.5.1. The vulnerability allows unauthenticated attackers to access sensitive audit logs by querying TimelineLog records. These logs contain details like analyst usernames, object identifiers, actions performed, and before-and-after object data, exposing operational history of threat-intelligence objects.

Detection Guidance

Check Yeti version with 'pip show yeti' or 'yeti --version'. If version is below 2.5.1, the system is vulnerable. Inspect network traffic for unauthenticated requests to /api/v2/audit/timeline/{id} endpoints.

Impact Analysis

If you use Yeti versions prior to 2.5.1, an attacker could exploit this to view sensitive operational data. This includes usernames, object changes, and actions taken in the system, potentially leading to further attacks or data breaches. Upgrading to version 2.5.1 or later mitigates this risk.

Compliance Impact

This vulnerability could violate compliance requirements like GDPR or HIPAA by exposing sensitive user data and operational logs. Unauthorized access to such data may result in legal penalties, reputational damage, and failure to meet regulatory standards for data protection and audit trails.

Mitigation Strategies

Upgrade Yeti to version 2.5.1 or later immediately. Ensure all API endpoints enforce authentication checks. Review audit logs for unauthorized access attempts to timeline endpoints.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63482. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...