PT-2026-40908 · Unknown · Yaay Social Media App

Aybora Ünveren · CVE-2025-12008 · Published 2026-05-14 · Updated 2026-05-14

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Yaay Social Media App versions 3.8.0 through 24102025

Description An authorization bypass exists due to a user-controlled key, which allows access to functionality not properly constrained by Access Control Lists (ACLs), which are sets of rules that define permissions for users or systems to access specific resources.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2025-12008

Affected Products

Yaay Social Media App

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2025-12008 · Security Note
• https://t.me/CVEtracker/53781 · Telegram Post
• https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0238 · Note