This vulnerability in Yandex Database involves improper permission handling due to LDAP filter injection. An attacker who already has valid LDAP credentials can exploit this flaw to bypass group membership verification, thereby accessing database resources without proper authorization. The issue affects versions before 25.3.1.25. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no user interaction required, and limited impact on confidentiality, integrity, and availability. No vendor advisory or patch information is provided, and the product is not a cloud service.

Successful exploitation allows an attacker with valid LDAP credentials to circumvent group membership checks, leading to unauthorized access to the database. This could result in exposure or modification of sensitive data depending on the database contents and access controls. The impact is limited by the requirement for valid LDAP credentials and the medium CVSS score.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict LDAP credential distribution and monitor for suspicious access patterns. No official patch or workaround information is currently available.