CVE-2026-91774 YaoApp CVE debrief

Who should care

Defenders and security teams responsible for the Yao application, especially those handling sensitive team data, should assess exposure and prioritize mitigation. This includes IT administrators, security personnel, and teams responsible for data protection and compliance. They should review the vulnerability details, assess the potential impact on their systems, and implement necessary controls to prevent unauthorized access to team data.

Why it matters

CVE-2026-91774 is a medium-severity vulnerability in the Yao application that allows authenticated users to read full team records without proper authorization, potentially leading to data leakage and confidentiality impacts. Defenders should prioritize verifying and mitigating this vulnerability, especially in systems where team data sensitivity is high.

• Potential unauthorized access to sensitive team data, including names, descriptions, owner information, and settings.
• Possible data leakage due to lack of authorization checks on team data retrieval.
• Need for verification of Yao application version and implementation of proper authorization checks.
• Potential impact on team data confidentiality and integrity.

Technical summary

The Yao application through version 1.0.0-rc22 has a vulnerability where any logged-in user can read full team records by supplying a known team identifier to the GET /user/teams/:id endpoint, due to a lack of authorization checks. This allows unauthorized access to sensitive team data, including names, descriptions, owner information, and settings. The vulnerability has a CVSS score of 5.3 and is classified as MEDIUM severity. Defenders should prioritize verifying and mitigating this vulnerability, especially in systems where team data sensitivity is high.

Defensive priority

Defenders should prioritize verifying and mitigating this vulnerability, especially in systems where team data sensitivity is high.

Recommended defensive actions

• Verify the Yao application version and check if it's vulnerable (version 1.0.0-rc22 or earlier).
• Restrict access to the GET /user/teams/:id endpoint to authorized users only.
• Implement proper authorization checks for team data retrieval.
• Monitor team data access and review logs for potential unauthorized access.
• Perform a thorough review of team data access controls and ensure that only authorized personnel have access to sensitive information.
• Consider implementing additional security measures, such as IP restrictions or multi-factor authentication, to further protect team data.
• Review and update incident response plans to address potential data breaches resulting from this vulnerability.

Evidence notes

The CVE record and NVD detail page provide information on the vulnerability, including its CVSS score of 5.3 and MEDIUM severity. The source references include links to the Yao GitHub repository and a Vulncheck advisory.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.