{"affected":[{"product":"yeti","source":"CNA: GitHub_M","vendor":"yeti-platform","versions":[{"status":"affected","version":"< 2.5.1"}]}],"cveId":"CVE-2026-63482","cwes":["CWE-306"],"description":"Yeti bridges the gap between CTI and DFIR practitioners by providing a Forensics Intelligence platform and pipeline. Prior to 2.5.1, YETI registers the audit router without Depends(auth.get_current_active_user), and core/web/apiv2/audit.py does not perform a route-level authentication check for /api/v2/audit/timeline/{id}. An unauthenticated network attacker can use an empty, partial, or specific wildcard path to query TimelineLog records containing the actor, target_id, action, and details fields, including analyst usernames, object identifiers and values, and before-and-after object data. This exposes the operational history of threat-intelligence objects while other application routers require authentication. This issue is fixed in version 2.5.1.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":7.5,"severity":"high","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"}],"modifiedAt":1793734513496,"publishedAt":1793734513496,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/yeti-platform/yeti/security/advisories/GHSA-34r4-95hx-gxqr"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/yeti-platform/yeti/pull/1276"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/yeti-platform/yeti/commit/692af02ffc05faabc8638b15a88765cb0e3f2503"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/yeti-platform/yeti/releases/tag/2.5.1"}],"remediation":[],"revision":"d44d48dc96ae80f13a57da36a00e39a14a371a07f4fa7c9e6bee6176592e753f","sources":[{"modifiedAt":1793734513496,"name":"CNA: GitHub_M","retrievedAt":1793736602650,"url":"https://www.cve.org/CVERecord?id=CVE-2026-63482"}],"ssvc":null,"status":"published","title":"Yeti: Unauthenticated Access to Full Audit Timeline Discloses All Threat Intelligence Data","updatedAt":1793736602650}