CVE-2025-12008: Yaay Social Media App Authorization Bypass Exposes User Data

The National Vulnerability Database has disclosed CVE-2025-12008, a critical authorization bypass vulnerability affecting APPYAP Technology and Information Inc.’s Yaay Social Media App. This flaw, present in versions 3.8.0 through 24102025, allows unauthenticated attackers to access functionalities not properly restricted by Access Control Lists (ACLs). The high CVSS score of 8.8 underscores the severity, indicating potential for attackers to achieve high impact on confidentiality, integrity, and availability.

This vulnerability stems from a user-controlled key mechanism, as detailed by CWE-639. Attackers can leverage this to bypass intended security checks, potentially leading to unauthorized data access, modification, or disruption of services. Given the nature of social media platforms, this could expose sensitive user information or allow malicious actors to impersonate users or manipulate content.

Defenders must prioritize patching or updating affected Yaay Social Media App instances immediately. Organizations should audit their environments for any unauthorized access or anomalous activity related to the app. Understanding the attack vector—accessing restricted functions via manipulated keys—is crucial for threat hunting and incident response.