This vulnerability (CVE-2025-12008) in the Yaay Social Media App involves an authorization bypass caused by improper access control enforcement related to a user-controlled key. Specifically, the app fails to properly constrain access to certain functionality via Access Control Lists (ACLs), allowing an attacker to access features or data they should not be authorized to use. The affected versions range from 3.8.0 through 24102025. The CVSS 3.1 base score is 8.8, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an attacker to bypass authorization controls and gain unauthorized access to sensitive functions or data within the Yaay Social Media App. This could lead to full compromise of user data confidentiality, integrity, and availability. Given the high CVSS score, the impact is considered severe. However, there are no reports of active exploitation in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or temporary fix is provided, users and administrators should monitor the vendor's communications for updates. Until a fix is available, consider restricting access to the affected app versions and applying compensating controls if possible.