Vulnerability-Lookup

CVE-2026-44595 (GCVE-0-2026-44595)

Vulnerability from cvelistv5 – Published: 2026-07-16 16:02 – Updated: 2026-07-18 02:57

Title

Yamcs: Unauthorized user enumeration via IAM API endpoints

Summary

Yamcs is a mission control framework. Prior to 5.12.7, the IAM API endpoints listUsers, getUser, listGroups, and getGroup in yamcs-core did not enforce the required SystemPrivilege.ControlAccess check in yamcs-core/src/main/java/org/yamcs/http/api/IamApi.java, so any authenticated user, even one with low or no privileges, could enumerate all user accounts in the system including their usernames, superuser status, and group memberships. This issue is fixed in versions 5.12.7 and 5.13.0.

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-862 - Missing Authorization

Assigner

GitHub_M

References

5 references

URL	Tags
https://github.com/yamcs/yamcs/security/advisorie…	x_refsource_CONFIRM
https://github.com/yamcs/yamcs/commit/0e12b518f10…	x_refsource_MISC
https://github.com/yamcs/yamcs/commit/e90099fba98…	x_refsource_MISC
https://github.com/yamcs/yamcs/releases/tag/yamcs…	x_refsource_MISC
https://github.com/yamcs/yamcs/releases/tag/yamcs…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
yamcs	yamcs	Affected: < 5.12.7

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-44595",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-18T02:56:44.582521Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-18T02:57:18.980Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/yamcs/yamcs/security/advisories/GHSA-p2rj-mrmc-9w29"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "yamcs",
          "vendor": "yamcs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 5.12.7"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Yamcs is a mission control framework. Prior to 5.12.7, the IAM API endpoints listUsers, getUser, listGroups, and getGroup in yamcs-core did not enforce the required SystemPrivilege.ControlAccess check in yamcs-core/src/main/java/org/yamcs/http/api/IamApi.java, so any authenticated user, even one with low or no privileges, could enumerate all user accounts in the system including their usernames, superuser status, and group memberships. This issue is fixed in versions 5.12.7 and 5.13.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-16T16:02:46.293Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/yamcs/yamcs/security/advisories/GHSA-p2rj-mrmc-9w29",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/yamcs/yamcs/security/advisories/GHSA-p2rj-mrmc-9w29"
        },
        {
          "name": "https://github.com/yamcs/yamcs/commit/0e12b518f103f24681299318a30a460fe4327b88",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/yamcs/yamcs/commit/0e12b518f103f24681299318a30a460fe4327b88"
        },
        {
          "name": "https://github.com/yamcs/yamcs/commit/e90099fba98e96214217c195b6a5b87b5f46e51c",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/yamcs/yamcs/commit/e90099fba98e96214217c195b6a5b87b5f46e51c"
        },
        {
          "name": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.7"
        },
        {
          "name": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.0"
        }
      ],
      "source": {
        "advisory": "GHSA-p2rj-mrmc-9w29",
        "discovery": "UNKNOWN"
      },
      "title": "Yamcs: Unauthorized user enumeration via IAM API endpoints"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-44595",
    "datePublished": "2026-07-16T16:02:46.293Z",
    "dateReserved": "2026-05-06T21:49:12.426Z",
    "dateUpdated": "2026-07-18T02:57:18.980Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-44595",
      "date": "2026-07-17",
      "epss": "0.01019",
      "percentile": "0.59496"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-44595\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-07-16T17:16:55.740\",\"lastModified\":\"2026-07-18T03:16:35.680\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Yamcs is a mission control framework. Prior to 5.12.7, the IAM API endpoints listUsers, getUser, listGroups, and getGroup in yamcs-core did not enforce the required SystemPrivilege.ControlAccess check in yamcs-core/src/main/java/org/yamcs/http/api/IamApi.java, so any authenticated user, even one with low or no privileges, could enumerate all user accounts in the system including their usernames, superuser status, and group memberships. This issue is fixed in versions 5.12.7 and 5.13.0.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"yamcs\",\"product\":\"yamcs\",\"versions\":[{\"version\":\"\u003c 5.12.7\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N\",\"baseScore\":4.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":1.4}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-07-18T02:56:44.582521Z\",\"id\":\"CVE-2026-44595\",\"options\":[{\"exploitation\":\"poc\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-862\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:spaceapplications:yamcs:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"5.12.7\",\"matchCriteriaId\":\"1F836127-88FB-4BD4-AD07-FE5B324349CD\"}]}]}],\"references\":[{\"url\":\"https://github.com/yamcs/yamcs/commit/0e12b518f103f24681299318a30a460fe4327b88\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/yamcs/yamcs/commit/e90099fba98e96214217c195b6a5b87b5f46e51c\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.7\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Release Notes\"]},{\"url\":\"https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.0\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Release Notes\"]},{\"url\":\"https://github.com/yamcs/yamcs/security/advisories/GHSA-p2rj-mrmc-9w29\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Exploit\",\"Vendor Advisory\"]},{\"url\":\"https://github.com/yamcs/yamcs/security/advisories/GHSA-p2rj-mrmc-9w29\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"tags\":[\"Exploit\",\"Vendor Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-44595\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-07-18T02:56:44.582521Z\"}}}], \"references\": [{\"url\": \"https://github.com/yamcs/yamcs/security/advisories/GHSA-p2rj-mrmc-9w29\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-07-18T02:57:04.570Z\"}}], \"cna\": {\"title\": \"Yamcs: Unauthorized user enumeration via IAM API endpoints\", \"source\": {\"advisory\": \"GHSA-p2rj-mrmc-9w29\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 4.3, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"LOW\"}}], \"affected\": [{\"vendor\": \"yamcs\", \"product\": \"yamcs\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 5.12.7\"}]}], \"references\": [{\"url\": \"https://github.com/yamcs/yamcs/security/advisories/GHSA-p2rj-mrmc-9w29\", \"name\": \"https://github.com/yamcs/yamcs/security/advisories/GHSA-p2rj-mrmc-9w29\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/yamcs/yamcs/commit/0e12b518f103f24681299318a30a460fe4327b88\", \"name\": \"https://github.com/yamcs/yamcs/commit/0e12b518f103f24681299318a30a460fe4327b88\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/yamcs/yamcs/commit/e90099fba98e96214217c195b6a5b87b5f46e51c\", \"name\": \"https://github.com/yamcs/yamcs/commit/e90099fba98e96214217c195b6a5b87b5f46e51c\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.7\", \"name\": \"https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.7\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.0\", \"name\": \"https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.0\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Yamcs is a mission control framework. Prior to 5.12.7, the IAM API endpoints listUsers, getUser, listGroups, and getGroup in yamcs-core did not enforce the required SystemPrivilege.ControlAccess check in yamcs-core/src/main/java/org/yamcs/http/api/IamApi.java, so any authenticated user, even one with low or no privileges, could enumerate all user accounts in the system including their usernames, superuser status, and group memberships. This issue is fixed in versions 5.12.7 and 5.13.0.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-862\", \"description\": \"CWE-862: Missing Authorization\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-07-16T16:02:46.293Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-44595\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-07-18T02:57:18.980Z\", \"dateReserved\": \"2026-05-06T21:49:12.426Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-07-16T16:02:46.293Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-44595

Vulnerability from fkie_nvd - Published: 2026-07-16 17:16 - Updated: 2026-07-18 03:16

Severity

4.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Summary

References

URL	Tags
security-advisories@github.com	https://github.com/yamcs/yamcs/commit/0e12b518f103f24681299318a30a460fe4327b88	Patch
security-advisories@github.com	https://github.com/yamcs/yamcs/commit/e90099fba98e96214217c195b6a5b87b5f46e51c	Patch
security-advisories@github.com	https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.7	Release Notes
security-advisories@github.com	https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.0	Release Notes
security-advisories@github.com	https://github.com/yamcs/yamcs/security/advisories/GHSA-p2rj-mrmc-9w29	Exploit, Vendor Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/yamcs/yamcs/security/advisories/GHSA-p2rj-mrmc-9w29	Exploit, Vendor Advisory

Impacted products

	Vendor	Product	Version
	spaceapplications	yamcs	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "yamcs",
          "vendor": "yamcs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 5.12.7"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:spaceapplications:yamcs:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "1F836127-88FB-4BD4-AD07-FE5B324349CD",
              "versionEndExcluding": "5.12.7",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Yamcs is a mission control framework. Prior to 5.12.7, the IAM API endpoints listUsers, getUser, listGroups, and getGroup in yamcs-core did not enforce the required SystemPrivilege.ControlAccess check in yamcs-core/src/main/java/org/yamcs/http/api/IamApi.java, so any authenticated user, even one with low or no privileges, could enumerate all user accounts in the system including their usernames, superuser status, and group memberships. This issue is fixed in versions 5.12.7 and 5.13.0."
    }
  ],
  "id": "CVE-2026-44595",
  "lastModified": "2026-07-18T03:16:35.680",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 1.4,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-44595",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-07-18T02:56:44.582521Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-07-16T17:16:55.740",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/yamcs/yamcs/commit/0e12b518f103f24681299318a30a460fe4327b88"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/yamcs/yamcs/commit/e90099fba98e96214217c195b6a5b87b5f46e51c"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Release Notes"
      ],
      "url": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.7"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Release Notes"
      ],
      "url": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.0"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/yamcs/yamcs/security/advisories/GHSA-p2rj-mrmc-9w29"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/yamcs/yamcs/security/advisories/GHSA-p2rj-mrmc-9w29"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-P2RJ-MRMC-9W29

Vulnerability from github – Published: 2026-05-27 00:03 – Updated: 2026-05-27 00:03

Summary

Yamcs vulnerable to unauthorized user enumeration via IAM API endpoints

Details

Summary

The IAM API endpoints (listUsers, getUser, listGroups, and getGroup) in yamcs-core do not enforce the required SystemPrivilege.ControlAccess check. As a result, any authenticated user (even those with low or no privileges) can enumerate all user accounts in the system, including their usernames, superuser status, and group memberships.

This constitutes a broken access control vulnerability (CWE-862) that leaks sensitive user information.

Root Cause

File: yamcs-core/src/main/java/org/yamcs/http/api/IamApi.java:125,180,357,372

listUsers(), getUser(), listGroups(), and getGroup() do not require SystemPrivilege.ControlAccess. Any authenticated user — regardless of privileges — can enumerate all users, their superuser status, and group memberships:

// listUsers — NO checkSystemPrivilege
public void listUsers(Context ctx, Empty request, ...) {
    var sensitiveDetails = ctx.user.hasSystemPrivilege(SystemPrivilege.ControlAccess);
    // sensitiveDetails=false for low-priv users, but name/superuser/active still exposed
    for (User user : users) {
        UserInfo userb = toUserInfo(user, sensitiveDetails, directory);
        responseb.addUsers(userb);
    }
}

Compare with properly protected endpoints:

// createUser — correctly protected
public void createUser(Context ctx, ...) {
    ctx.checkSystemPrivilege(SystemPrivilege.ControlAccess); // present

Impact

Any authenticated user can:

List all user accounts in the system
Identify which accounts have superuser privileges
Use this information to target privileged accounts

Proof of Concept

# Authenticate as any low-privilege user GET access_token
curl -s -X POST "http://localhost:8090/auth/token" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=password&username=lowpriv&password=lowpriv123"

# Enumerate all users — no ControlAccess required
curl -s "http://TARGET:8090/api/users" \
  -H "Authorization: Bearer $TOKEN" #paste access_token

Output (confirmed):

{
  "users": [
    { "name": "admin", "superuser": true, "active": true },
    { "name": "operator", "superuser": true, "active": true },
    { "name": "lowpriv", "superuser": false, "active": true }
  ]
}

Fix

Add ControlAccess check to listUsers, getUser, listGroups, getGroup:

public void listUsers(Context ctx, Empty request, ...) {
    ctx.checkSystemPrivilege(SystemPrivilege.ControlAccess); // ADD THIS
    ...
}

Severity

4.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.yamcs:yamcs-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.12.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-44595"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-27T00:03:56Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Summary\n\nThe IAM API endpoints (`listUsers`, `getUser`, `listGroups`, and `getGroup`) in `yamcs-core` do not enforce the required `SystemPrivilege.ControlAccess` check. As a result, **any authenticated user** (even those with low or no privileges) can enumerate all user accounts in the system, including their usernames, superuser status, and group memberships.\n\nThis constitutes a broken access control vulnerability (CWE-862) that leaks sensitive user information.\n\n### Root Cause\n\n**File:** `yamcs-core/src/main/java/org/yamcs/http/api/IamApi.java:125,180,357,372`\n\n`listUsers()`, `getUser()`, `listGroups()`, and `getGroup()` do not require `SystemPrivilege.ControlAccess`. Any authenticated user \u2014 regardless of privileges \u2014 can enumerate all users, their superuser status, and group memberships:\n\n```java\n// listUsers \u2014 NO checkSystemPrivilege\npublic void listUsers(Context ctx, Empty request, ...) {\n    var sensitiveDetails = ctx.user.hasSystemPrivilege(SystemPrivilege.ControlAccess);\n    // sensitiveDetails=false for low-priv users, but name/superuser/active still exposed\n    for (User user : users) {\n        UserInfo userb = toUserInfo(user, sensitiveDetails, directory);\n        responseb.addUsers(userb);\n    }\n}\n```\n\nCompare with properly protected endpoints:\n\n```java\n// createUser \u2014 correctly protected\npublic void createUser(Context ctx, ...) {\n    ctx.checkSystemPrivilege(SystemPrivilege.ControlAccess); // present\n```\n\n### Impact\n\nAny authenticated user can:\n\n1. List all user accounts in the system\n2. Identify which accounts have superuser privileges\n3. Use this information to target privileged accounts\n\n### Proof of Concept\n\n```bash\n# Authenticate as any low-privilege user GET access_token\ncurl -s -X POST \"http://localhost:8090/auth/token\" \\\n  -H \"Content-Type: application/x-www-form-urlencoded\" \\\n  -d \"grant_type=password\u0026username=lowpriv\u0026password=lowpriv123\"\n\n# Enumerate all users \u2014 no ControlAccess required\ncurl -s \"http://TARGET:8090/api/users\" \\\n  -H \"Authorization: Bearer $TOKEN\" #paste access_token\n```\n\n**Output (confirmed):**\n\n```json\n{\n  \"users\": [\n    { \"name\": \"admin\", \"superuser\": true, \"active\": true },\n    { \"name\": \"operator\", \"superuser\": true, \"active\": true },\n    { \"name\": \"lowpriv\", \"superuser\": false, \"active\": true }\n  ]\n}\n```\n\n### Fix\n\nAdd `ControlAccess` check to `listUsers`, `getUser`, `listGroups`, `getGroup`:\n\n```java\npublic void listUsers(Context ctx, Empty request, ...) {\n    ctx.checkSystemPrivilege(SystemPrivilege.ControlAccess); // ADD THIS\n    ...\n}\n```",
  "id": "GHSA-p2rj-mrmc-9w29",
  "modified": "2026-05-27T00:03:56Z",
  "published": "2026-05-27T00:03:56Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/yamcs/yamcs/security/advisories/GHSA-p2rj-mrmc-9w29"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/yamcs/yamcs"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Yamcs vulnerable to unauthorized user enumeration via IAM API endpoints"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-44595 (GCVE-0-2026-44595)

FKIE_CVE-2026-44595

GHSA-P2RJ-MRMC-9W29

Summary

Root Cause

Impact

Proof of Concept

Fix

Tags

Sightings

Nomenclature