CVE-2026-44595

Yamcs is a mission control framework. Prior to 5.12.7, the IAM API endpoints listUsers, getUser, listGroups, and getGroup in yamcs-core did not enforce the required SystemPrivilege.ControlAccess check in yamcs-core/src/main/java/org/yamcs/http/api/IamApi.java, so any authenticated user, even one with low or no privileges, could enumerate all user accounts in the system including their usernames, superuser status, and group memberships. This issue is fixed in versions 5.12.7 and 5.13.0.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/yamcs/yamcs/commit/0e12b518f103f24681299318a30a460fe4327b88	Patch
https://github.com/yamcs/yamcs/commit/e90099fba98e96214217c195b6a5b87b5f46e51c	Patch
https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.7	Release Notes
https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.0	Release Notes
https://github.com/yamcs/yamcs/security/advisories/GHSA-p2rj-mrmc-9w29	Exploit Vendor Advisory
https://github.com/yamcs/yamcs/security/advisories/GHSA-p2rj-mrmc-9w29	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:spaceapplications:yamcs:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-07-16 17:16

Updated : 2026-07-18 03:16

NVD link : CVE-2026-44595

Mitre link : CVE-2026-44595

CVE.ORG link : CVE-2026-44595

JSON object : View

Products Affected

spaceapplications

yamcs

CWE

CWE-862

Missing Authorization

{"id": "CVE-2026-44595", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44595", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-18T02:56:44.582521Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "yamcs", "product": "yamcs", "versions": [{"status": "affected", "version": "< 5.12.7"}]}]}], "published": "2026-07-16T17:16:55.740", "references": [{"url": "https://github.com/yamcs/yamcs/commit/0e12b518f103f24681299318a30a460fe4327b88", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/yamcs/yamcs/commit/e90099fba98e96214217c195b6a5b87b5f46e51c", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.7", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.0", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/yamcs/yamcs/security/advisories/GHSA-p2rj-mrmc-9w29", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/yamcs/yamcs/security/advisories/GHSA-p2rj-mrmc-9w29", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "Yamcs is a mission control framework. Prior to 5.12.7, the IAM API endpoints listUsers, getUser, listGroups, and getGroup in yamcs-core did not enforce the required SystemPrivilege.ControlAccess check in yamcs-core/src/main/java/org/yamcs/http/api/IamApi.java, so any authenticated user, even one with low or no privileges, could enumerate all user accounts in the system including their usernames, superuser status, and group memberships. This issue is fixed in versions 5.12.7 and 5.13.0."}], "lastModified": "2026-07-18T03:16:35.680", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:spaceapplications:yamcs:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1F836127-88FB-4BD4-AD07-FE5B324349CD", "versionEndExcluding": "5.12.7"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}