Yeti Platform EUVD-2026-116264

No special conditions - remote unauthenticated exploitation against default configurations of any Yeti instance prior to 2.5.1 whose /api/v2 API is network-reachable. The only prerequisite is network reachability of the Yeti API (default port 8000); the audit router ships without the Depends(auth.get_current_active_user) gate that every other router enforces, so no account, API key, session token, or non-default setting is required and an empty/partial/wildcard {id:path} returns all records. Limiting factors: impact is confined to read-only disclosure of TimelineLog data (actor, target_id, action, details) with no integrity or availability effect, and exploitation requires that the attacker can route to the API endpoint, so instances behind a reverse proxy, VPN, or network ACL that blocks direct API access are not externally exposed.

All signals point to a genuine, easy-to-exploit information-disclosure flaw. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes network-reachable, low-complexity, fully unauthenticated access with no user interaction, and C:H/I:N/A:N correctly scopes the impact to confidentiality only - there is no code execution or integrity/availability loss, so the 7.5 score is read-disclosure, not system compromise. The root cause (CWE-306, missing router-level auth dependency) is confirmed by the GHSA advisory, PR #1276 diff, and the 2.5.1 release, and a working proof-of-concept (curl against /api/v2/audit/timeline/ with an empty path) with live validation output is published in the advisory itself, so exploitation is trivial for anyone who can reach the API. No CISA KEV listing and no EPSS score are present in the input, so there is no evidence of active in-the-wild exploitation yet; the vuln.today decision label is 'this_week', indicating prompt but not emergency remediation. Net: this is a real priority for any exposed Yeti instance - low attack cost, no auth barrier, and high-value data (the entire operational CTI dataset plus analyst identities) - tempered only by the confidentiality-only impact and the niche deployment footprint of the product.

An unauthenticated attacker who can reach a pre-2.5.1 Yeti instance's API issues GET /api/v2/audit/timeline/ with an empty path segment and receives the full TimelineLog, exposing every analyst username and the values and before/after edit history of all observables, indicators, and entities. Because the vector is network, low-complexity, and requires no privileges or user interaction, no special tooling is needed - the GHSA advisory publishes the exact curl commands along with live validation output confirming an HTTP 200 and full record dump.