Yealink YMCS OpenAPI Access Control Bypass Vulnerability for Frozen Enterprise Accounts

A vulnerability exists in Yealink YMCS versions prior to 2025-05-26, where the system does not properly restrict OpenAPI access for frozen enterprise accounts. This flaw allows unauthorized users to access deactivated interfaces.

Impact

Exploitation of this vulnerability could lead to unauthorized access to deactivated OpenAPI interfaces, potentially allowing for unauthorized actions or data access through these interfaces.

Remediation

Yealink has released a security update on May 26, 2025, which has been automatically deployed to all YMCS cloud service instances. For additional information, customers can contact Yealink technical support.