CVE-2026-91774 in Yao
Summary
by MITRE • 09/15/2026
Yao through v1.0.0-rc22 authenticates but fails to authorize the GET /user/teams/:id endpoint, allowing any logged-in user to read full team records. Attackers can supply a known team identifier to retrieve sensitive team data including name, description, owner information, and settings without membership verification.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/15/2026
The vulnerability identified in Yao through version 1.0.0-rc22 represents a critical failure in access control mechanisms, specifically categorized under CWE-862: Missing Authorization. While the application correctly implements authentication to verify user identity via session tokens or credentials, it completely neglects to validate whether the authenticated user possesses the necessary privileges to access specific resources. This architectural flaw allows any logged-in individual to bypass membership checks when interacting with the GET /user/teams/:id endpoint. The system accepts a team identifier provided by the client and proceeds to fetch and return the full record associated with that identifier without verifying if the requesting user is actually a member of that team or holds an administrative role within it.
From a technical perspective, this issue stems from a logic error in the backend route handler for team retrieval operations. Instead of querying the database for membership relationships between the current session's user ID and the requested team ID before returning data, the application directly maps the input parameter to the resource lookup function. This oversight means that if an attacker can guess or obtain a valid team identifier through enumeration techniques such as sequential ID probing or information leakage from other endpoints, they can successfully retrieve sensitive information. The absence of server-side authorization checks renders client-side restrictions ineffective and allows for straightforward exploitation by any authenticated actor with network access to the service.
The operational impact of this vulnerability is significant due to the sensitivity of the data exposed. Successful exploitation enables an attacker to read full team records, which include names, descriptions, owner information, and internal settings. Exposure of owner information can facilitate further social engineering attacks or targeted phishing campaigns against high-privilege accounts within those teams. Furthermore, access to team settings may reveal configuration details that could aid in identifying other security weaknesses, such as misconfigured integrations or exposed API keys stored in team preferences. This level of data leakage violates the principle of least privilege and compromises the confidentiality integrity required for secure multi-tenant applications.
In terms of industry frameworks, this vulnerability aligns with MITRE ATT&CK technique T1078: Valid Accounts, as it leverages legitimate credentials to access unauthorized resources. It also relates to CWE-269: Improper Privilege Management and CWE-352: Cross-Site Request Forgery if the endpoint is vulnerable to CSRF attacks that could force authenticated users to inadvertently trigger data exfiltration requests on behalf of an attacker, although the primary issue here is direct unauthorized access via valid sessions. The flaw essentially allows for horizontal privilege escalation where a user with lower privileges accesses resources belonging to peers or other groups without permission.
To mitigate this vulnerability, developers must implement robust server-side authorization checks at every endpoint that handles sensitive data. Specifically, before returning any team information, the application should query the database to confirm that the authenticated user's ID exists in the membership table for the requested team ID. If no such relationship is found, the server must return a 403 Forbidden status code rather than the resource data or a generic error message that might leak existence of the team. Additionally, implementing rate limiting on this endpoint can help mitigate enumeration attacks where attackers attempt to guess valid team IDs by monitoring response times or error patterns. Regular security audits and static application security testing should be employed to detect such logic flaws early in the development lifecycle.