CVE-2026-91774
Yao through v1.0.0-rc22 Missing Authorization via OpenAPI team endpoint
CVSS 4.0 5.3 MEDIUMCVSS 3.1 4.3 MEDIUMCheck source for fixed versionsKEV status unknown
cve-program · CVE-2026-91774
PublishedYao through v1.0.0-rc22 authenticates but fails to authorize the GET /user/teams/:id endpoint, allowing any logged-in user to read full team records. Attackers can supply a known team identifier to retrieve sensitive team data including name, description, owner information, and settings without membership verification.
Read the publisher's advisoryAffected versions, risk and source history
Related advisories and sources
Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.
CVE-2026-91774 · CVE overview and exploitation status
cve-program · CVE-2026-91774
- https://github.com/YaoApp/yao/issues/1553
- https://github.com/YaoApp/yao/blob/v1.0.0-rc22/openapi/user/team.go#L80-L149
- https://github.com/YaoApp/yao/blob/v1.0.0-rc22/openapi/oauth/providers/user/team.go#L37-L55
- https://github.com/YaoApp/yao
- https://www.vulncheck.com/advisories/yao-through-1.0.0-rc22-missing-authorization-via-openapi-team-endpoint
Related changes
Linked by CVE identifierNo related changes are available here.