YETI Platform CVE-2026-63489

Requires a valid but low-privileged (non-admin) authenticated YETI account; no administrator role is needed. The attacker must be able to call one of the search endpoints (POST /api/v2/observables/search, /entities/search, /indicators/search, /dfiq/search, /search/, or /graph/search) and supply a sorting field or a filter_aliases attribute path, which are interpolated unvalidated into AQL identifier/expression positions in the filter() and neighbors() construction. No special non-default configuration is needed - default search functionality is exploitable. The primary limiting factor is the authentication requirement (PR:L): anonymous internet users cannot exploit it, so realistic risk centers on insiders or compromised analyst credentials; impact is bounded to read/search contexts, so arbitrary database writes were not established.

This is a credible, verified authenticated injection flaw rather than an inflated high-CVSS score. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) describes a network-reachable, low-complexity attack needing only a low-privileged authenticated account and no user interaction, which is consistent with the GHSA advisory's live-lab confirmation of an AQL syntax-error oracle, a successful cross-collection subquery against the internal users collection, and failure against a bogus collection - proving attacker-controlled AQL is actually parsed and evaluated. The vuln.today decision label is 'this_week' (priority but not act_now/emergency), and there is no CISA KEV listing and no EPSS score provided, so there is no evidence of widespread active exploitation; the realistic risk is targeted abuse by an already-authenticated insider or a compromised analyst account. Signals are largely consistent: the only tension is that the C:H rating is somewhat generous given the verified impact is cross-collection expression evaluation and error-oracle enumeration rather than a demonstrated bulk data dump, and the advisory itself notes the integrity/availability components could be scored more conservatively. EPSS is absent and KEV is NO, so priority rests on the reproducible PoC and the low privilege barrier, not on observed in-the-wild use.

A user with any ordinary (non-admin) YETI account - or an attacker who has phished/compromised such an account - sends a crafted POST to a search endpoint with a malicious sorting or filter_aliases value that closes the intended identifier and appends attacker AQL. Because low complexity and no user interaction are required, they can repeatedly probe the database as an error/boolean oracle to enumerate collections and evaluate subqueries against internal collections such as users, or issue deliberately expensive AQL to burden ArangoDB. The GHSA advisory includes detailed, lab-verified curl PoCs for all three injection patterns.