CVE-2026-91774

MediumCVSS 4.3/10Last modified Sep 23, 2026

Description

Yao through v1.0.0-rc22 authenticates but fails to authorize the GET /user/teams/:id endpoint, allowing any logged-in user to read full team records. Attackers can supply a known team identifier to retrieve sensitive team data including name, description, owner information, and settings without membership verification.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
YaoApp	yao	<= 1.0.0-rc22

References

Timeline

Published: Sep 15, 2026
Last modified: Sep 23, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-917757.4LimeSurvey Community Edition 7.0.14 fails to safely encode attacker-controlled content from a crafted .lss survey file when displaying impor CVE-2026-917767.5TypeDeserializerBase._findDeserializer() in FasterXML jackson-databind caches the resolved deserializer under the raw, attacker-supplied typ CVE-2026-917777.5Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference CVE-2026-917787.2In affected versions of Octopus Server, users with certain scoped permission sets could execute arbitrary scripts on a worker (including the CVE-2026-917793.3A security flaw has been discovered in GNU Binutils 2.47. This affects the function _bfd_elf_eh_frame_section_offset of the file bfd/elf-eh-CVE-2026-91787.5The WP Forms Connector plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.8. The plugin regi CVE-2026-917803.3A weakness has been identified in GNU Binutils 2.47. This impacts the function elf_link_add_object_symbols of the file bfd/elflink.c. Execut CVE-2026-917813.3A security vulnerability has been detected in GNU Binutils 2.47. Affected is the function elf_x86_64_common_section_index of the file bfd/el CVE-2026-917823.3A vulnerability was detected in GNU Binutils 2.47. Affected by this vulnerability is the function elf_x86_allocate_dynrelocs of the file bfd CVE-2026-917844.8cjbassi/gotop is vulnerable to local argument injection via process termination functionality. The process name is passed directly to pkill CVE-2026-917866.1A flaw was found in GNOME Shell. When processing icons from a remote search provider via D-Bus, the system fails to validate the icon's decl CVE-2026-917885.5When implementing the JavaScript interface, Foxit PDF Editor/Reader did not perform the attribute authorization checks required by the speci