CVE-2026-92783

Yeti (through version 2.11.0 ) fails to validate caller permissions in the DELETE /api/v2/rbac/{id} endpoint, allowing users with only read access to delete access control (RBAC) relationships. An attacker can revoke the owner's grant and permanently lock legitimate owners out of objects . The vu...

A grant cannot be removed if the user has already claimed/withdrawn all his tokens beforehand

Lines of code Vulnerability details The revokeGrant is used to removes a grant. Any available vested tokens will be sent to the grant recipient. Any remaining unvested tokens will be sent to the vesting manager. But in the case when the user has already claimed all his tokens, the revokeGrant wil...

SUSE CVE-2022-23041

Linux PV device frontends vulnerable to attacks by backends This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. Several Linux PV device frontends are using the grant table interfaces for removing access rights of the...