Threats tagged 'ghsa-w297-93hv-q3cx'

Yeti platform versions up to and including 2.11.0 have a missing authorization check in the DELETE /api/v2/rbac/{id} endpoint. This flaw allows users with only read access to delete access control relationships, potentially revoking the owner's permissions and locking legitimate owners out of objects.