{"id":"CVE-2026-127102","aliases":["EUVD-2026-125345","GHSA-x45g-v897-hmfm"],"status":"published","title":"In Eclipse BaSyx Go Components versions up to and including 1.1.2, ABAC-enabled deployments of...","description":"In Eclipse BaSyx Go Components versions up to and including 1.1.2, ABAC-enabled deployments of the Submodel Repository and the AAS Environment return Submodel Elements that the caller is not authorized to read from `GET /submodels/{submodelIdentifier}/submodel-elements`.\n\n\n\nIf an access rule grants READ on a single Submodel Element through a `$sme` `REFERABLE` object, the list route returns every element of that Submodel, including its value, as soon as one element matches the caller's rules. The single-element route and the full Submodel read enforce the same rule and deny access to the other elements. An authenticated caller with a READ grant for one element of a Submodel can therefore read all other elements of that Submodel.\n\n\n\nThe issue is fixed in Eclipse BaSyx Go Components v1.1.3.","severity":{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-200","CWE-863"],"published":"2026-11-13T14:22:11Z","modified":"2026-11-14T02:47:34Z","products":[{"vendor":"eclipse foundation","product":"eclipse basyx go components"}],"references":[{"url":"https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/1371","tags":["web"]},{"url":"https://github.com/eclipse-basyx/basyx-go-components/commit/693e3c72b0dbdaf2c36a1112fde4c77b5d1ead3f","tags":["fix"]},{"url":"https://github.com/eclipse-basyx/basyx-go-components/releases/tag/v1.1.3","tags":["web"]},{"url":"https://gitlab.eclipse.org/security/cve-assignment/-/work_items/574","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-127102","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-x45g-v897-hmfm"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/127xxx/CVE-2026-127102.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-127102","description":"In Eclipse BaSyx Go Components versions up to and including 1.1.2, ABAC-enabled deployments of the Submodel Repository and the AAS Environment return Submodel Elements that the caller is not authorized to read from `GET /submodels/{submodelIdentifier}/submodel-elements`.\n\n\n\nIf an access rule grants READ on a single Submodel Element through a `$sme` `REFERABLE` object, the list route returns every element of that Submodel, including its value, as soon as one element matches the caller's rules. The single-element route and the full Submodel read enforce the same rule and deny access to the other elements. An authenticated caller with a READ grant for one element of a Submodel can therefore read all other elements of that Submodel.\n\n\n\nThe issue is fixed in Eclipse BaSyx Go Components v1.1.3.","status":"published","published":"2026-11-13T14:22:11.926Z","modified":"2026-11-13T14:22:11.926Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna"}],"cwes":["CWE-863","CWE-200"],"updated_at":"2026-11-13T15:30:58.141376Z"}],"euvd":[{"id":"EUVD-2026-125345","description":"In Eclipse BaSyx Go Components versions up to and including 1.1.2, ABAC-enabled deployments of the Submodel Repository and the AAS Environment return Submodel Elements that the caller is not authorized to read from `GET /submodels/{submodelIdentifier}/submodel-elements`.\n\n\n\nIf an access rule grants READ on a single Submodel Element through a `$sme` `REFERABLE` object, the list route returns every element of that Submodel, including its value, as soon as one element matches the caller's rules. The single-element route and the full Submodel read enforce the same rule and deny access to the other elements. An authenticated caller with a READ grant for one element of a Submodel can therefore read all other elements of that Submodel.\n\n\n\nThe issue is fixed in Eclipse BaSyx Go Components v1.1.3.","status":"published","published":"2026-11-13T14:22:11Z","modified":"2026-11-13T14:22:11Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-13T17:39:29.007679Z"}],"ghsa":[{"id":"GHSA-x45g-v897-hmfm","title":"In Eclipse BaSyx Go Components versions up to and including 1.1.2, ABAC-enabled deployments of...","description":"In Eclipse BaSyx Go Components versions up to and including 1.1.2, ABAC-enabled deployments of the Submodel Repository and the AAS Environment return Submodel Elements that the caller is not authorized to read from `GET /submodels/{submodelIdentifier}/submodel-elements`.\n\n\n\nIf an access rule grants READ on a single Submodel Element through a `$sme` `REFERABLE` object, the list route returns every element of that Submodel, including its value, as soon as one element matches the caller's rules. The single-element route and the full Submodel read enforce the same rule and deny access to the other elements. An authenticated caller with a READ grant for one element of a Submodel can therefore read all other elements of that Submodel.\n\n\n\nThe issue is fixed in Eclipse BaSyx Go Components v1.1.3.","status":"published","published":"2026-11-13T15:31:45Z","modified":"2026-11-13T15:31:46Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"cwes":["CWE-200"],"updated_at":"2026-11-13T15:51:21.353356Z"}],"nvd":[{"id":"CVE-2026-127102","description":"In Eclipse BaSyx Go Components versions up to and including 1.1.2, ABAC-enabled deployments of the Submodel Repository and the AAS Environment return Submodel Elements that the caller is not authorized to read from `GET /submodels/{submodelIdentifier}/submodel-elements`.\n\n\n\nIf an access rule grants READ on a single Submodel Element through a `$sme` `REFERABLE` object, the list route returns every element of that Submodel, including its value, as soon as one element matches the caller's rules. The single-element route and the full Submodel read enforce the same rule and deny access to the other elements. An authenticated caller with a READ grant for one element of a Submodel can therefore read all other elements of that Submodel.\n\n\n\nThe issue is fixed in Eclipse BaSyx Go Components v1.1.3.","status":"published","published":"2026-11-13T15:17:44.177Z","modified":"2026-11-13T15:17:44.177Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"}],"cwes":["CWE-200","CWE-863"],"updated_at":"2026-11-13T17:36:48.675401Z"}],"osv":[{"id":"CVE-2026-127102","description":"In Eclipse BaSyx Go Components versions up to and including 1.1.2, ABAC-enabled deployments of the Submodel Repository and the AAS Environment return Submodel Elements that the caller is not authorized to read from `GET /submodels/{submodelIdentifier}/submodel-elements`.\n\n\n\nIf an access rule grants READ on a single Submodel Element through a `$sme` `REFERABLE` object, the list route returns every element of that Submodel, including its value, as soon as one element matches the caller's rules. The single-element route and the full Submodel read enforce the same rule and deny access to the other elements. An authenticated caller with a READ grant for one element of a Submodel can therefore read all other elements of that Submodel.\n\n\n\nThe issue is fixed in Eclipse BaSyx Go Components v1.1.3.","status":"published","published":"2026-11-13T14:22:11.926Z","modified":"2026-11-14T02:47:34.867257237Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-200","CWE-863"],"updated_at":"2026-11-14T03:11:06.681237Z"}]}}