EUVD-2026-361462

fkie_cve-2026-55547

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs omits SystemPrivilege.ControlAccess checks from IamApi.listRoles, IamApi.getRole, and IamApi.listPrivileges in yamcs-core/src/main/java/org/yamcs/http/api/IamApi.java. Any authenticated account can call GET /api/roles, GET /api/roles/{name}, and GET /api/privileges to enumerate available system privileges and configured role mappings. The disclosure reveals security configuration that can support targeted privilege-escalation attempts. This issue is fixed in versions 5.12.8 and 5.13.2.

GHSA-cvw4-55pp-3hfq — Yamcs's Missing Authorization on Role and Privilege Enumeration Endpoints Allows Any Authenticated User to Disclose Ful…

Affected: Maven: org.yamcs:yamcs-core

## Summary

Missing authorization checks on three IAM API endpoints (`GET /api/roles`, `GET /api/roles/{name}`, `GET /api/privileges`) allow any authenticated user — regardless of their assigned permissions — to enumerate the complete list of system privileges and role definitions. An attacker with only a low-privilege account (e.g., a read-only operator) can retrieve the full privilege taxonomy of the server, including the names and assignments of all administrator-level capabilities. This information directly enables targeted privilege escalation attacks.

---

## Details

Three handler methods in `IamApi.java` serve sensitive security metadata without performing any authorization check:

**File:** `yamcs-core/src/main/java/org/yamcs/http/api/IamApi.java`

```java // Line 73 — GET /api/roles @Override public void listRoles(Context ctx, Empty request, Observer<ListRolesResponse> observer) { SecurityStore securityStore = YamcsServer.getServer().getSecurityStore(); List<Role> roles = securityStore.getDirectory().getRoles(); // No ctx.checkSystemPrivilege() call — any authenticated user proceeds ... observer.complete(responseb.build()); }

// Line 87 — GET /api/roles/{name} @Override public void getRole(Context ctx, GetRoleRequest request, Observer<RoleInfo> observer) { SecurityStore securityStore = YamcsServer.getServer().getSecurityStore(); Role role = securityStore.getDirectory().getRole(request.getName()); // No ctx.checkSystemPrivilege() ca…

Most recent entries from all

EUVD-2026-361462

fkie_cve-2026-55547

GHSA-cvw4-55pp-3hfq — Yamcs's Missing Authorization on Role and Privilege Enumeration Endpoints Allows Any Authenticated User to Disclose Ful…