A flaw in Yeti's audit router allows unauthenticated users to query the TimelineLog endpoint at /api/v2/audit/timeline/{id} without required authentication checks. Attackers can obtain detailed records that expose actor identities, target identifiers, actions performed, and before-and-after object data, including analyst usernames and threat‑intelligence object values. The result is a confidentiality breach that reveals operational history normally protected behind authentication, satisfying CWE‑306: Missing Authentication.

The vulnerability affects the Yeti Platform Yeti product, specifically any installation running a version earlier than 2.5.1. This includes all prior releases that had not yet deployed the 2.5.1 patch, which restores authentication for the audit route.

The CVSS score of 7.5 indicates a high risk to confidentiality and integrity, and the EPSS score is not available, but the lack of a KEV listing suggests no widespread exploitation yet. Attackers can exploit this remotely by sending unauthenticated HTTP requests over the network to the vulnerable endpoint. The impact is limited to information disclosure; no privilege escalation or service disruption is required, making the vulnerability easier to exploit on accessible networks.