Description

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs omits authorization checks in IndexesApi.listPacketIndex, IndexesApi.listEventIndex, Cop1Api.disable, Cop1Api.resume, Cop1Api.initialize, Cop1Api.updateConfig, and TimeApi.setTime. An authenticated low-privilege user can read packet and event index metadata without ObjectPrivilegeType.ReadPacket, alter COP-1 link state without SystemPrivilege.ControlLinks, and manipulate simulation time. These operations can disclose telemetry metadata, disrupt telecommand handling, and affect system integrity and availability. This issue is fixed in versions 5.12.8 and 5.13.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-28T20:18:28.240Z",
  "pubdate": "2026-08-28T20:18:28.240Z",
  "executiveSummary": "Yamcs is susceptible to multiple missing authorization vulnerabilities across several API endpoints, which allow authenticated low-privilege users to bypass established security controls. The vulnerability exists in the IndexesApi, Cop1Api, and TimeApi components, where critical operations lack necessary permission checks.\nThe security impact is significant, as it enables unauthorized information disclosure of telemetry metadata, disruption of telecommand links via COP-1 state manipulation, and unauthorized modification of system time. These actions can compromise mission integrity, system availability, and operational safety.\nThe vulnerability affects Yamcs versions prior to 5.12.8 and 5.13.2. Exploitation requires an authenticated session with low-level privileges but does not require administrative or specific functional privileges. Successful exploitation results in unauthorized access to sensitive operational data and control over mission-critical telecommand subsystems.",
  "technicalDetails": "The root cause of this vulnerability is the absence of programmatic access control checks within the API layer of the Yamcs framework. Specifically, the application fails to validate the user's ObjectPrivilegeType or SystemPrivilege permissions before executing requests in the identified API modules.\nAffected components include IndexesApi (listPacketIndex, listEventIndex), Cop1Api (disable, resume, initialize, updateConfig), and TimeApi (setTime).\nIn the context of the IndexesApi, the lack of validation for ObjectPrivilegeType.ReadPacket allows any authenticated user to query packet and event index metadata. This leads to information disclosure, as attackers can enumerate system telemetry structures and event logs without the authorized privilege level.\nFor the Cop1Api, the failure to verify SystemPrivilege.ControlLinks allows unauthorized users to modify the state of the COP-1 telecommand link. An attacker can invoke operations such as disable, resume, initialize, or updateConfig to interrupt command uplink services, directly affecting mission availability and telecommand integrity.\nIn the TimeApi, the missing authorization for setTime allows unauthorized modification of the simulation time. This manipulation can lead to inconsistencies in time-tagged data, disrupt time-based automated procedures, and undermine the reliability of the telemetry processing chain.\nThe attack flow involves an authenticated user crafting specific HTTP requests directed at these API endpoints. Since the underlying business logic does not perform a security check against the authenticated user's session token or permission set, the server processes the request as a legitimate command. This bypasses the intended security architecture that restricts these operations to users with higher privilege levels.\nThe vulnerability affects all deployments of Yamcs versions prior to 5.12.8 and 5.13.2. There are no complex exploitation requirements beyond having a valid user account, as the vulnerability is inherent to the server-side authorization logic rather than a client-side flaw or complex memory corruption issue."
}