https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 17:37:41 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-361446 EUVD-2026-361446 https://cve.radiocsirt.org/vuln/euvd-2026-361446 https://cve.radiocsirt.org/vuln/fkie_cve-2026-55521 <p>Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs omits authorization checks in IndexesApi.listPacketIndex, IndexesApi.listEventIndex, Cop1Api.disable, Cop1Api.resume, Cop1Api.initialize, Cop1Api.updateConfig, and TimeApi.setTime. An authenticated low-privilege user can read packet and event index metadata without ObjectPrivilegeType.ReadPacket, alter COP-1 link state without SystemPrivilege.ControlLinks, and manipulate simulation time. These operations can disclose telemetry metadata, disrupt telecommand handling, and affect system integrity and availability. This issue is fixed in versions 5.12.8 and 5.13.2.</p> <p>Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs omits authorization checks in IndexesApi.listPacketIndex, IndexesApi.listEventIndex, Cop1Api.disable, Cop1Api.resume, Cop1Api.initialize, Cop1Api.updateConfig, and TimeApi.setTime. An authenticated low-privilege user can read packet and event index metadata without ObjectPrivilegeType.ReadPacket, alter COP-1 link state without SystemPrivilege.ControlLinks, and manipulate simulation time. These operations can disclose telemetry metadata, disrupt telecommand handling, and affect system integrity and availability. This issue is fixed in versions 5.12.8 and 5.13.2.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-55521 https://cve.radiocsirt.org/vuln/ghsa-962x-ccwf-8x6p <p><strong>Affected:</strong> Maven: org.yamcs:yamcs-core</p> <p>### Summary Multiple Missing Function Level Access Control vulnerabilities exist in the Yamcs Core API. These vulnerabilities allow any authenticated user, regardless of their assigned roles or privileges (e.g., an unprivileged &#34;Guest&#34;), to bypass intended access controls. An attacker can exploit these flaws to extract sensitive telemetry metadata, disrupt satellite communication link protocols (COP-1), and manipulate the global simulation time, severely impacting the confidentiality, integrity, and availability of the system.</p> <p>### Details Yamcs utilizes a robust Role-Based Access Control (RBAC) model with `SystemPrivilege` and `ObjectPrivilege` to restrict administrative actions and data retrieval. However, three critical API controllers completely omit these authorization checks before executing internal business logic:</p> <p>1. **`IndexesApi.java` (Information Disclosure):** Unlike `PacketsApi.java`, which filters results using `ctx.user.hasObjectPrivilege(ObjectPrivilegeType.ReadPacket, packetName)`, methods in `IndexesApi` (such as `listPacketIndex` and `listEventIndex`) directly retrieve and return archive records from the `CcsdsTmIndex` without verifying if the user has the required Object Privileges. 2. **`Cop1Api.java` (Denial of Service / Integrity):** Modifying the COP-1 telecommand protocol state is an administrative action requiring `SystemPrivilege.ControlLinks`. However, endpoints in `Cop1Api` (e.g., `disable`, `resume`, `initialize`, `updateConfig`) process link…</p> <p><strong>Affected:</strong> Maven: org.yamcs:yamcs-core</p> <p>### Summary Multiple Missing Function Level Access Control vulnerabilities exist in the Yamcs Core API. These vulnerabilities allow any authenticated user, regardless of their assigned roles or privileges (e.g., an unprivileged &#34;Guest&#34;), to bypass intended access controls. An attacker can exploit these flaws to extract sensitive telemetry metadata, disrupt satellite communication link protocols (COP-1), and manipulate the global simulation time, severely impacting the confidentiality, integrity, and availability of the system.</p> <p>### Details Yamcs utilizes a robust Role-Based Access Control (RBAC) model with `SystemPrivilege` and `ObjectPrivilege` to restrict administrative actions and data retrieval. However, three critical API controllers completely omit these authorization checks before executing internal business logic:</p> <p>1. **`IndexesApi.java` (Information Disclosure):** Unlike `PacketsApi.java`, which filters results using `ctx.user.hasObjectPrivilege(ObjectPrivilegeType.ReadPacket, packetName)`, methods in `IndexesApi` (such as `listPacketIndex` and `listEventIndex`) directly retrieve and return archive records from the `CcsdsTmIndex` without verifying if the user has the required Object Privileges. 2. **`Cop1Api.java` (Denial of Service / Integrity):** Modifying the COP-1 telecommand protocol state is an administrative action requiring `SystemPrivilege.ControlLinks`. However, endpoints in `Cop1Api` (e.g., `disable`, `resume`, `initialize`, `updateConfig`) process link…</p> https://cve.radiocsirt.org/vuln/ghsa-962x-ccwf-8x6p