CVE-2026-91774: Yao through v1.0.0-rc22 Missing Authorization via OpenAPI team endpoint
Published Sep 15, 2026
·Updated
Yao through v1.0.0-rc22 authenticates but fails to authorize the GET /user/teams/:id endpoint, allowing any logged-in user to read full team records. Attackers can supply a known team identifier to retrieve sensitive team data including name, description, owner information, and settings without membership verification.
Affected Software
1 affected component
Yao<=1.0.0-rc22
Event History
Sep 15, 2026
CVE Published
via MITRE·01:20 AM
Data Sourced
via MITRE·01:20 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
Any authenticated Yao user can exploit it. The attacker needs a known team identifier; team membership is not verified.
2
What information can be exposed?
The endpoint can return full team records, including the team name, description, owner information, and settings.
3
Are unauthenticated attackers affected?
No. The affected endpoint authenticates users, so an attacker must be logged in.