Yao
Monthly
Yao (YaoApp) through v1.0.0-rc22 allows any authenticated user to read complete team records via the GET /user/teams/:id endpoint, which authenticates the caller but never verifies team membership. Attackers who hold a low-privilege account and know or guess a team identifier can retrieve team name, description, owner information and settings. The flaw is remotely reachable with low complexity but yields only low confidentiality impact (CVSS 5.3), and no public exploit code or CISA KEV entry was identified at time of analysis.
Yao (YaoApp) through v1.0.0-rc22 allows any authenticated user to read complete team records via the GET /user/teams/:id endpoint, which authenticates the caller but never verifies team membership. Attackers who hold a low-privilege account and know or guess a team identifier can retrieve team name, description, owner information and settings. The flaw is remotely reachable with low complexity but yields only low confidentiality impact (CVSS 5.3), and no public exploit code or CISA KEV entry was identified at time of analysis.