Authorization Bypass in Yao App Affects User Team Data Access

CVE-2026-91774

What is CVE-2026-91774?

The Yao application version v1.0.0-rc22 contains a significant flaw where authentication is present but fails to enforce authorization properly on the GET /user/teams/:id endpoint. This flaw allows any authenticated user to access sensitive team information without proper membership verification. Attackers can exploit this vulnerability by supplying any known team identifier, enabling them to extract confidential details such as team names, descriptions, owner information, and various settings, which should be restricted to authorized members only.

References