CVE-2026-128986

In Eclipse BaSyx Go Components versions up to and including 1.1.3, ABAC-enabled deployments match ROUTE access rules against the fully decoded request path, while the router routes on the raw, still encoded path. An encoded slash (%2F) inside a path value is a segment separator for the access check but part of the value for the router, so a request can match a narrow ROUTE rule while the handler returns a different, larger resource.

An authenticated caller whose rules grant READ only on parts of a resource can therefore read the whole resource. In the DPP API, a rule such as /v1/dpps/*/elements/*, meant to grant only passport elements, also grants the complete passport whose identifier contains /elements/. In the Submodel Repository, AAS Repository and AAS Environment, a rule such as /submodels/*/submodel-elements/*/attachment, meant to grant only file attachments, also grants the complete element whose stored idShort contains %2F.

The issue is fixed in Eclipse BaSyx Go Components v1.1.4.

In Eclipse BaSyx Go Components versions up to and including 1.1.3, ABAC-enabled deployments match ROUTE access rules against the fully decoded request path, while the router routes on the raw, still encoded path. An encoded slash (%2F) inside a path value is a segment separator for the access check but part of the value for the router, so a request can match a narrow ROUTE rule while the handler returns a different, larger resource.

An authenticated caller whose rules grant READ only on parts of a resource can therefore read the whole resource. In the DPP API, a rule such as /v1/dpps/*/elements/*, meant to grant only passport elements, also grants the complete passport whose identifier contains /elements/. In the Submodel Repository, AAS Repository and AAS Environment, a rule such as /submodels/*/submodel-elements/*/attachment, meant to grant only file attachments, also grants the complete element whose stored idShort contains %2F.

The issue is fixed in Eclipse BaSyx Go Components v1.1.4.

In Eclipse BaSyx Go Components versions up to and including 1.1.3, ABAC-enabled deployments match ROUTE access rules against the fully decoded request path, while the router routes on the raw, still encoded path. An encoded slash (%2F) inside a path value is a segment separator for the access check but part of the value for the router, so a request can match a narrow ROUTE rule while the handler returns a different, larger resource.

An authenticated caller whose rules grant READ only on parts of a resource can therefore read the whole resource. In the DPP API, a rule such as /v1/dpps/*/elements/*, meant to grant only passport elements, also grants the complete passport whose identifier contains /elements/. In the Submodel Repository, AAS Repository and AAS Environment, a rule such as /submodels/*/submodel-elements/*/attachment, meant to grant only file attachments, also grants the complete element whose stored idShort contains %2F.

The issue is fixed in Eclipse BaSyx Go Components v1.1.4.

In Eclipse BaSyx Go Components versions up to and including 1.1.3, ABAC-enabled deployments match ROUTE access rules against the fully decoded request path, while the router routes on the raw, still encoded path. An encoded slash (%2F) inside a path value is a segment separator for the access check but part of the value for the router, so a request can match a narrow ROUTE rule while the handler returns a different, larger resource.

An authenticated caller whose rules grant READ only on parts of a resource can therefore read the whole resource. In the DPP API, a rule such as /v1/dpps/*/elements/*, meant to grant only passport elements, also grants the complete passport whose identifier contains /elements/. In the Submodel Repository, AAS Repository and AAS Environment, a rule such as /submodels/*/submodel-elements/*/attachment, meant to grant only file attachments, also grants the complete element whose stored idShort contains %2F.

The issue is fixed in Eclipse BaSyx Go Components v1.1.4.