Description

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs omits SystemPrivilege.ControlAccess checks from IamApi.listRoles, IamApi.getRole, and IamApi.listPrivileges in yamcs-core/src/main/java/org/yamcs/http/api/IamApi.java. Any authenticated account can call GET /api/roles, GET /api/roles/{name}, and GET /api/privileges to enumerate available system privileges and configured role mappings. The disclosure reveals security configuration that can support targeted privilege-escalation attempts. This issue is fixed in versions 5.12.8 and 5.13.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-28T20:18:28.517Z",
  "pubdate": "2026-08-28T20:18:28.517Z",
  "executiveSummary": "Yamcs is affected by an improper authorization vulnerability that allows authenticated users to bypass access control checks.\nThe vulnerability resides in the IamApi component, where specific API endpoints fail to enforce the required SystemPrivilege.ControlAccess check.\nThis oversight permits any authenticated account to enumerate system privileges and role configurations, which are sensitive security artifacts.\nThe primary risk implication is the exposure of internal security mappings, facilitating reconnaissance for targeted privilege-escalation attacks.\nExploitation does not require elevated privileges, only valid authentication within the Yamcs framework.\nThe issue affects versions prior to 5.12.8 and 5.13.2.\nThis vulnerability is categorized as an improper access control issue, potentially leading to unauthorized information disclosure.",
  "technicalDetails": "The root cause of this vulnerability is a missing authorization check within the IamApi implementation located at yamcs-core/src/main/java/org/yamcs/http/api/IamApi.java.\nSpecifically, the functions listRoles, getRole, and listPrivileges fail to invoke the SystemPrivilege.ControlAccess validation logic before processing user requests.\nThe vulnerability manifests through the HTTP API, allowing authenticated users to execute GET requests against /api/roles, /api/roles/{name}, and /api/privileges without appropriate authorization.\nThe attack flow involves an authenticated actor crafting HTTP GET requests to the aforementioned API endpoints. Because the underlying Java code does not verify the requester's permissions against the required privilege, the application proceeds to return sensitive configuration data to the requester.\nThe returned data includes the structure of roles and the list of available system privileges. This information effectively exposes the authorization landscape of the Yamcs instance.\nFrom an attacker's perspective, this provides deep insight into the security model of the mission control framework. By enumerating roles and privileges, an attacker can identify misconfigured accounts, determine the scope of administrative capabilities, or map out the organizational hierarchy within the system.\nThis disclosure serves as a critical reconnaissance step in a multi-stage attack. By mapping the security configuration, an attacker can tailor subsequent exploits to target specific high-privilege roles or identify pathways to achieve unauthorized administrative access.\nThe affected versions are strictly those prior to 5.12.8 and 5.13.2. As the vulnerability is located in the backend API logic, it persists regardless of the front-end interface used, provided the attacker can interface with the Yamcs HTTP API.\nPost-exploitation, the threat actor possesses a detailed map of the system's security architecture, which significantly lowers the barrier for privilege escalation and further system compromise."
}