CVE-2026-55547

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs omits SystemPrivilege.ControlAccess checks from IamApi.listRoles, IamApi.getRole, and IamApi.listPrivileges in yamcs-core/src/main/java/org/yamcs/http/api/IamApi.java. Any authenticated account can call GET /api/roles, GET /api/roles/{name}, and GET /api/privileges to enumerate available system privileges and configured role mappings. The disclosure reveals security configuration that can support targeted privilege-escalation attempts. This issue is fixed in versions 5.12.8 and 5.13.2.

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs omits SystemPrivilege.ControlAccess checks from IamApi.listRoles, IamApi.getRole, and IamApi.listPrivileges in yamcs-core/src/main/java/org/yamcs/http/api/IamApi.java. Any authenticated account can call GET /api/roles, GET /api/roles/{name}, and GET /api/privileges to enumerate available system privileges and configured role mappings. The disclosure reveals security configuration that can support targeted privilege-escalation attempts. This issue is fixed in versions 5.12.8 and 5.13.2.

Summary

Missing authorization checks on three IAM API endpoints (GET /api/roles, GET /api/roles/{name}, GET /api/privileges) allow any authenticated user — regardless of their assigned permissions — to enumerate the complete list of system privileges and role definitions. An attacker with only a low-privilege account (e.g., a read-only operator) can retrieve the full privilege taxonomy of the server, including the names and assignments of all administrator-level capabilities. This information directly enables targeted privilege escalation attacks.

Details

Three handler methods in IamApi.java serve sensitive security metadata without performing any authorization check:

File: yamcs-core/src/main/java/org/yamcs/http/api/IamApi.java

// Line 73 — GET /api/roles
@Override
public void listRoles(Context ctx, Empty request, Observer<ListRolesResponse> observer) {
    SecurityStore securityStore = YamcsServer.getServer().getSecurityStore();
    List<Role> roles = securityStore.getDirectory().getRoles();
    // No ctx.checkSystemPrivilege() call — any authenticated user proceeds
    ...
    observer.complete(responseb.build());
}

// Line 87 — GET /api/roles/{name}
@Override
public void getRole(Context ctx, GetRoleRequest request, Observer<RoleInfo> observer) {
    SecurityStore securityStore = YamcsServer.getServer().getSecurityStore();
    Role role = securityStore.getDirectory().getRole(request.getName());
    // No ctx.checkSystemPrivilege() call
    observer.complete(toRoleInfo(role));
}

// Line 112 — GET /api/privileges
@Override
public void listPrivileges(Context ctx, Empty request, Observer<ListPrivilegesResponse> observer) {
    SecurityStore securityStore = YamcsServer.getServer().getSecurityStore();
    List<SystemPrivilege> privileges = new ArrayList<>(securityStore.getSystemPrivileges());
    // No ctx.checkSystemPrivilege() call
    observer.complete(responseb.build());
}

By contrast, all write operations and user-management endpoints in the same file correctly enforce authorization. For example:

// Line 126 — GET /api/users (correctly protected)
public void listUsers(...) {
    ctx.checkSystemPrivilege(SystemPrivilege.ControlAccess);  // ← present
    ...
}

// Line 142 — POST /api/users (correctly protected)
public void createUser(...) {
    ctx.checkSystemPrivilege(SystemPrivilege.ControlAccess);  // ← present
    ...
}

The three vulnerable endpoints share the same ControlAccess protection requirement as the user-management endpoints but were never given the corresponding check.

Route definitions (confirmed in yamcs-api/src/main/proto/yamcs/protobuf/iam/iam.proto):

GET /api/privileges   → IamApi.listPrivileges()
GET /api/roles        → IamApi.listRoles()
GET /api/roles/{name} → IamApi.getRole()

PoC

<img width="2324" height="1086" alt="image" src="https://github.com/user-attachments/assets/98ec3e81-556d-41e1-9211-10a5b9ad0d59" />

Environment

• Yamcs version: 5.13.1-SNAPSHOT (latest master)
• Auth module: YamlAuthModule (default)
• Two accounts available: admin (Administrator) and operator (Operator)
• Calculate the Basic Auth credentials for the two accounts (this needs to be done only once). Please modify according to the actual situation. These credentials will be used in subsequent commands. Here, there is a test low-privilege account named "operator" with the password "password".

<img width="2243" height="223" alt="image" src="https://github.com/user-attachments/assets/5614013c-2143-4f61-aba3-eab1cba24b67" />

powershell -command "[Convert]::ToBase64String([Text.Encoding]::ASCII.GetBytes('admin:admin'))"

powershell -command "[Convert]::ToBase64String([Text.Encoding]::ASCII.GetBytes('operator:password'))"

Step 1 — Confirm that protected endpoints correctly return 403 for low-privilege users

curl -s -o nul -w "HTTP %{http_code}" http://localhost:8090/api/users -H "Authorization:…

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs omits SystemPrivilege.ControlAccess checks from IamApi.listRoles, IamApi.getRole, and IamApi.listPrivileges in yamcs-core/src/main/java/org/yamcs/http/api/IamApi.java. Any authenticated account can call GET /api/roles, GET /api/roles/{name}, and GET /api/privileges to enumerate available system privileges and configured role mappings. The disclosure reveals security configuration that can support targeted privilege-escalation attempts. This issue is fixed in versions 5.12.8 and 5.13.2.

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs omits SystemPrivilege.ControlAccess checks from IamApi.listRoles, IamApi.getRole, and IamApi.listPrivileges in yamcs-core/src/main/java/org/yamcs/http/api/IamApi.java. Any authenticated account can call GET /api/roles, GET /api/roles/{name}, and GET /api/privileges to enumerate available system privileges and configured role mappings. The disclosure reveals security configuration that can support targeted privilege-escalation attempts. This issue is fixed in versions 5.12.8 and 5.13.2.

Summary

Missing authorization checks on three IAM API endpoints (GET /api/roles, GET /api/roles/{name}, GET /api/privileges) allow any authenticated user — regardless of their assigned permissions — to enumerate the complete list of system privileges and role definitions. An attacker with only a low-privilege account (e.g., a read-only operator) can retrieve the full privilege taxonomy of the server, including the names and assignments of all administrator-level capabilities. This information directly enables targeted privilege escalation attacks.

Details

Three handler methods in IamApi.java serve sensitive security metadata without performing any authorization check:

File: yamcs-core/src/main/java/org/yamcs/http/api/IamApi.java

// Line 73 — GET /api/roles
@Override
public void listRoles(Context ctx, Empty request, Observer<ListRolesResponse> observer) {
    SecurityStore securityStore = YamcsServer.getServer().getSecurityStore();
    List<Role> roles = securityStore.getDirectory().getRoles();
    // No ctx.checkSystemPrivilege() call — any authenticated user proceeds
    ...
    observer.complete(responseb.build());
}

// Line 87 — GET /api/roles/{name}
@Override
public void getRole(Context ctx, GetRoleRequest request, Observer<RoleInfo> observer) {
    SecurityStore securityStore = YamcsServer.getServer().getSecurityStore();
    Role role = securityStore.getDirectory().getRole(request.getName());
    // No ctx.checkSystemPrivilege() call
    observer.complete(toRoleInfo(role));
}

// Line 112 — GET /api/privileges
@Override
public void listPrivileges(Context ctx, Empty request, Observer<ListPrivilegesResponse> observer) {
    SecurityStore securityStore = YamcsServer.getServer().getSecurityStore();
    List<SystemPrivilege> privileges = new ArrayList<>(securityStore.getSystemPrivileges());
    // No ctx.checkSystemPrivilege() call
    observer.complete(responseb.build());
}

By contrast, all write operations and user-management endpoints in the same file correctly enforce authorization. For example:

// Line 126 — GET /api/users (correctly protected)
public void listUsers(...) {
    ctx.checkSystemPrivilege(SystemPrivilege.ControlAccess);  // ← present
    ...
}

// Line 142 — POST /api/users (correctly protected)
public void createUser(...) {
    ctx.checkSystemPrivilege(SystemPrivilege.ControlAccess);  // ← present
    ...
}

The three vulnerable endpoints share the same ControlAccess protection requirement as the user-management endpoints but were never given the corresponding check.

Route definitions (confirmed in yamcs-api/src/main/proto/yamcs/protobuf/iam/iam.proto):

GET /api/privileges   → IamApi.listPrivileges()
GET /api/roles        → IamApi.listRoles()
GET /api/roles/{name} → IamApi.getRole()

PoC

<img width="2324" height="1086" alt="image" src="https://github.com/user-attachments/assets/98ec3e81-556d-41e1-9211-10a5b9ad0d59" />

Environment

• Yamcs version: 5.13.1-SNAPSHOT (latest master)
• Auth module: YamlAuthModule (default)
• Two accounts available: admin (Administrator) and operator (Operator)
• Calculate the Basic Auth credentials for the two accounts (this needs to be done only once). Please modify according to the actual situation. These credentials will be used in subsequent commands. Here, there is a test low-privilege account named "operator" with the password "password".

<img width="2243" height="223" alt="image" src="https://github.com/user-attachments/assets/5614013c-2143-4f61-aba3-eab1cba24b67" />

powershell -command "[Convert]::ToBase64String([Text.Encoding]::ASCII.GetBytes('admin:admin'))"

powershell -command "[Convert]::ToBase64String([Text.Encoding]::ASCII.GetBytes('operator:password'))"

Step 1 — Confirm that protected endpoints correctly return 403 for low-privilege users

curl -s -o nul -w "HTTP %{http_code}" http://localhost:8090/api/users -H "Authorization:…