The vulnerability is an IDOR flaw where the Yaay Social Media App accepts a user‑controlled key without proper authorization checks, allowing an attacker to access functions that should be restricted. This can lead to unauthorized data access or manipulation, compromising confidentiality and integrity of user data. The weakness maps to CWE-639.

The flaw affects APPYAP Technology and Information Inc.'s Yaay Social Media App for all released versions from 3.8.0 through 24102025. Users running any of these builds are potentially exposed.

The CVSS score of 8.8 classifies it as high severity, and the lack of a published EPSS score suggests limited publicly known exploitation attempts at this time. The vulnerability is not listed in CISA's KEV catalog. An attacker could exploit the flaw remotely by supplying a crafted key in requests to bypass ACLs, provided the user has any authenticated session or can access the endpoint. The risk is therefore significant, especially for applications exposed to internet users.