CVE-2026-128790
In Eclipse BaSyx Go Components versions up to and including 1.1.2, ABAC-enabled deployments of...
CVE-2026-128790 is a high vulnerability (CVSS 7.1) in Eclipse Foundation Basyx Go Components, published November 13, 2026. No source lists public exploit code. No source names a fixed version.
- Severity
- 7.1 HighCVSS 4.0, CVE List
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
- No fix listedNo source names one
Description
In Eclipse BaSyx Go Components versions up to and including 1.1.2, ABAC-enabled deployments of the Submodel Repository and the AAS Environment do not apply an access rule's FILTERLIST fragment filters to single Submodel reads.
GET /submodels removes the fields that a rule's FILTERLIST hides, but GET /submodels/{submodelIdentifier} and GET /submodels/{submodelIdentifier}/$metadata return them unfiltered. An authenticated caller with READ access to a Submodel can therefore read fields that the access rules hide from them, for example supplementalSemanticIds keys that name the other parties allowed to read the Submodel.
If versioning is enabled (history.mode set to api or audit), GET /submodels/{submodelIdentifier}/$history and GET /shells/{aasIdentifier}/$history in the Submodel Repository, AAS Repository and AAS Environment return the complete stored version without applying the rule's formula or fragment filters. A caller whose rules grant READ on these routes can read fields that the access rules hide, and Submodels and Asset Administration Shells that the direct read does not return to them at all.
The issue is fixed in Eclipse BaSyx Go Components v1.1.3.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Affected products
What each source reports
CVE List Score used
In Eclipse BaSyx Go Components versions up to and including 1.1.2, ABAC-enabled deployments of the Submodel Repository and the AAS Environment do not apply an access rule's FILTERLIST fragment filters to single Submodel reads.
GET /submodels removes the fields that a rule's FILTERLIST hides, but GET /submodels/{submodelIdentifier} and GET /submodels/{submodelIdentifier}/$metadata return them unfiltered. An authenticated caller with READ access to a Submodel can therefore read fields that the access rules hide from them, for example supplementalSemanticIds keys that name the other parties allowed to read the Submodel.
If versioning is enabled (history.mode set to api or audit), GET /submodels/{submodelIdentifier}/$history and GET /shells/{aasIdentifier}/$history in the Submodel Repository, AAS Repository and AAS Environment return the complete stored version without applying the rule's formula or fragment filters. A caller whose rules grant READ on these routes can read fields that the access rules hide, and Submodels and Asset Administration Shells that the direct read does not return to them at all.
The issue is fixed in Eclipse BaSyx Go Components v1.1.3.
- Record
CVE-2026-128790- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-863, CWE-200
- Updated
- 2026-11-13
EUVDEUVD-2026-125342
In Eclipse BaSyx Go Components versions up to and including 1.1.2, ABAC-enabled deployments of the Submodel Repository and the AAS Environment do not apply an access rule's FILTERLIST fragment filters to single Submodel reads.
GET /submodels removes the fields that a rule's FILTERLIST hides, but GET /submodels/{submodelIdentifier} and GET /submodels/{submodelIdentifier}/$metadata return them unfiltered. An authenticated caller with READ access to a Submodel can therefore read fields that the access rules hide from them, for example supplementalSemanticIds keys that name the other parties allowed to read the Submodel.
If versioning is enabled (history.mode set to api or audit), GET /submodels/{submodelIdentifier}/$history and GET /shells/{aasIdentifier}/$history in the Submodel Repository, AAS Repository and AAS Environment return the complete stored version without applying the rule's formula or fragment filters. A caller whose rules grant READ on these routes can read fields that the access rules hide, and Submodels and Asset Administration Shells that the direct read does not return to them at all.
The issue is fixed in Eclipse BaSyx Go Components v1.1.3.
- Record
EUVD-2026-125342- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - Updated
- 2026-11-13
GitHub AdvisoriesGHSA-grwr-c8jg-hx89
In Eclipse BaSyx Go Components versions up to and including 1.1.2, ABAC-enabled deployments of...
In Eclipse BaSyx Go Components versions up to and including 1.1.2, ABAC-enabled deployments of the Submodel Repository and the AAS Environment do not apply an access rule's FILTERLIST fragment filters to single Submodel reads.
GET /submodels removes the fields that a rule's FILTERLIST hides, but GET /submodels/{submodelIdentifier} and GET /submodels/{submodelIdentifier}/$metadata return them unfiltered. An authenticated caller with READ access to a Submodel can therefore read fields that the access rules hide from them, for example supplementalSemanticIds keys that name the other parties allowed to read the Submodel.
If versioning is enabled (history.mode set to api or audit), GET /submodels/{submodelIdentifier}/$history and GET /shells/{aasIdentifier}/$history in the Submodel Repository, AAS Repository and AAS Environment return the complete stored version without applying the rule's formula or fragment filters. A caller whose rules grant READ on these routes can read fields that the access rules hide, and Submodels and Asset Administration Shells that the direct read does not return to them at all.
The issue is fixed in Eclipse BaSyx Go Components v1.1.3.
- Record
GHSA-grwr-c8jg-hx89- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Weakness
- CWE-200
- Updated
- 2026-11-13
NVD
In Eclipse BaSyx Go Components versions up to and including 1.1.2, ABAC-enabled deployments of the Submodel Repository and the AAS Environment do not apply an access rule's FILTERLIST fragment filters to single Submodel reads.
GET /submodels removes the fields that a rule's FILTERLIST hides, but GET /submodels/{submodelIdentifier} and GET /submodels/{submodelIdentifier}/$metadata return them unfiltered. An authenticated caller with READ access to a Submodel can therefore read fields that the access rules hide from them, for example supplementalSemanticIds keys that name the other parties allowed to read the Submodel.
If versioning is enabled (history.mode set to api or audit), GET /submodels/{submodelIdentifier}/$history and GET /shells/{aasIdentifier}/$history in the Submodel Repository, AAS Repository and AAS Environment return the complete stored version without applying the rule's formula or fragment filters. A caller whose rules grant READ on these routes can read fields that the access rules hide, and Submodels and Asset Administration Shells that the direct read does not return to them at all.
The issue is fixed in Eclipse BaSyx Go Components v1.1.3.
- Record
CVE-2026-128790- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Weakness
- CWE-200, CWE-863
- Updated
- 2026-11-13
OSV
In Eclipse BaSyx Go Components versions up to and including 1.1.2, ABAC-enabled deployments of the Submodel Repository and the AAS Environment do not apply an access rule's FILTERLIST fragment filters to single Submodel reads.
GET /submodels removes the fields that a rule's FILTERLIST hides, but GET /submodels/{submodelIdentifier} and GET /submodels/{submodelIdentifier}/$metadata return them unfiltered. An authenticated caller with READ access to a Submodel can therefore read fields that the access rules hide from them, for example supplementalSemanticIds keys that name the other parties allowed to read the Submodel.
If versioning is enabled (history.mode set to api or audit), GET /submodels/{submodelIdentifier}/$history and GET /shells/{aasIdentifier}/$history in the Submodel Repository, AAS Repository and AAS Environment return the complete stored version without applying the rule's formula or fragment filters. A caller whose rules grant READ on these routes can read fields that the access rules hide, and Submodels and Asset Administration Shells that the direct read does not return to them at all.
The issue is fixed in Eclipse BaSyx Go Components v1.1.3.
- Record
CVE-2026-128790- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-200, CWE-863
- Updated
- 2026-11-14
History
| Recorded | Changed | Sources |
|---|---|---|
| references | OSV | |
| published | EUVD | |
| published | EUVD | |
| aliases, references, title | GitHub Advisories | |
| aliases, published | EUVD, NVD | |
| first indexed | CVE List |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
gitlab.eclipse.org/security/vulnerability-reports/-/work_items/1371
github.com/eclipse-basyx/basyx-go-components/pull/855
nvd.nist.gov/vuln/detail/CVE-2026-128790