YaoApp

Records1All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical0CVSS 9.0–10.0

CVSS high0CVSS 7.0–8.9

Exploited now

YaoApp records in CISA KEV

No YaoApp vulnerabilities are listed in CISA KEV.

1 record

TI-2026-61985 CVE-2026-91774 · GHSA-9q89-m4c3-34ff

LOW 24

Yao through v1.0.0-rc22 authenticates but fails to authorize the GET /user/teams/:id endpoint, allowing any logged-in user to read full team records.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00342 Published 2026-09-15 No fix listed CWE-862