Executive brief
Yao is a self-hosted workspace and task management application. The application fails to verify team membership when a logged-in user requests details about a specific team, allowing any authenticated user to view sensitive team information (name, description, owner, and settings) for teams they don't belong to. This can expose confidential team data to unauthorized users.
Technical details
The GET /user/teams/:id endpoint in Yao through v1.0.0-rc22 performs authentication but lacks proper authorization checks. An authenticated attacker can supply any team identifier to retrieve full team records without verifying membership in that team. The vulnerability stems from missing authorization logic in the team.go handler. Attack preconditions include possession of valid login credentials; the attacker must be able to authenticate to the application and know or guess valid team identifiers. The impact is unauthorized read access to sensitive team metadata including owner information and settings.
Affected products
- Yao Yao through v1.0.0-rc22
Timeline
- 2026-09-15: disclosed