CVE-2026-91774 Details
Description
Yao through v1.0.0-rc22 authenticates but fails to authorize the GET /user/teams/:id endpoint, allowing any logged-in user to read full team records. Attackers can supply a known team identifier to retrieve sensitive team data including name, description, owner information, and settings without membership verification.
A vulnerability exists in Yao versions through 1.0.0-rc22, where the GET /user/teams/:id endpoint lacks proper authorization. This flaw allows any authenticated user to access full team records, including sensitive details such as the team name, description, owner information, and settings. The vulnerability arises because the endpoint authenticates users but fails to verify their membership in the requested team. Exploitation is possible by supplying a known team identifier, with former or removed team members retaining access to team details indefinitely.
Users can update to Yao version 1.0.0-rc23 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 15, 2026CISA-ADP
Assessed Sep 17, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/YaoApp/yao | [email protected] | Vendor |
| https://github.com/YaoApp/yao/blob/v1.0.0-rc22/openapi/oauth/providers/user/team.go#L37-L55 | [email protected] | Source CodeVendor |
| https://github.com/YaoApp/yao/blob/v1.0.0-rc22/openapi/user/team.go#L80-L149 | [email protected] | Source CodeVendor |
| https://github.com/YaoApp/yao/issues/1553 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://www.vulncheck.com/advisories/yao-through-1.0.0-rc22-missing-authorization-via-openapi-team-endpoint | [email protected] | AdvisoryBundleRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| YaoApp Yao | <= 1.0.0-rc22 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 17, 2026 | CVE Modified | CISA-ADP |
| Sep 15, 2026 | New CVE Received | [email protected] |