{"id":"CVE-2026-128986","aliases":["EUVD-2026-125520","GHSA-gjpm-3829-v3j3"],"status":"published","title":"In Eclipse BaSyx Go Components versions up to and including 1.1.3, ABAC-enabled deployments match...","description":"In Eclipse BaSyx Go Components versions up to and including 1.1.3, ABAC-enabled deployments match `ROUTE` access rules against the fully decoded request path, while the router routes on the raw, still encoded path. An encoded slash (`%2F`) inside a path value is a segment separator for the access check but part of the value for the router, so a request can match a narrow `ROUTE` rule while the handler returns a different, larger resource.\n\n\n\nAn authenticated caller whose rules grant READ only on parts of a resource can therefore read the whole resource. In the DPP API, a rule such as `/v1/dpps/*/elements/*`, meant to grant only passport elements, also grants the complete passport whose identifier contains `/elements/`. In the Submodel Repository, AAS Repository and AAS Environment, a rule such as `/submodels/*/submodel-elements/*/attachment`, meant to grant only file attachments, also grants the complete element whose stored idShort contains `%2F`.\n\n\n\nThe issue is fixed in Eclipse BaSyx Go Components v1.1.4.","severity":{"version":"4.0","score":6,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-177","CWE-436","CWE-863"],"published":"2026-11-13T16:27:04Z","modified":"2026-11-13T18:32:37Z","products":[{"vendor":"eclipse foundation","product":"eclipse basyx go components"}],"references":[{"url":"https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/1389"},{"url":"https://github.com/eclipse-basyx/basyx-go-components/pull/888"},{"url":"https://github.com/eclipse-basyx/basyx-go-components/releases/tag/v1.1.4"},{"url":"https://gitlab.eclipse.org/security/cve-assignment/-/work_items/582"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-128986"},{"url":"https://github.com/advisories/GHSA-gjpm-3829-v3j3"}],"sources":{"cve":[{"id":"CVE-2026-128986","description":"In Eclipse BaSyx Go Components versions up to and including 1.1.3, ABAC-enabled deployments match `ROUTE` access rules against the fully decoded request path, while the router routes on the raw, still encoded path. An encoded slash (`%2F`) inside a path value is a segment separator for the access check but part of the value for the router, so a request can match a narrow `ROUTE` rule while the handler returns a different, larger resource.\n\n\n\nAn authenticated caller whose rules grant READ only on parts of a resource can therefore read the whole resource. In the DPP API, a rule such as `/v1/dpps/*/elements/*`, meant to grant only passport elements, also grants the complete passport whose identifier contains `/elements/`. In the Submodel Repository, AAS Repository and AAS Environment, a rule such as `/submodels/*/submodel-elements/*/attachment`, meant to grant only file attachments, also grants the complete element whose stored idShort contains `%2F`.\n\n\n\nThe issue is fixed in Eclipse BaSyx Go Components v1.1.4.","status":"published","published":"2026-11-13T16:27:04.197Z","modified":"2026-11-13T16:27:04.197Z","cvss":[{"version":"4.0","score":6,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-863","CWE-436","CWE-177"],"updated_at":"2026-11-13T17:32:19.23761Z"}],"euvd":[{"id":"EUVD-2026-125520","description":"In Eclipse BaSyx Go Components versions up to and including 1.1.3, ABAC-enabled deployments match `ROUTE` access rules against the fully decoded request path, while the router routes on the raw, still encoded path. An encoded slash (`%2F`) inside a path value is a segment separator for the access check but part of the value for the router, so a request can match a narrow `ROUTE` rule while the handler returns a different, larger resource.\n\n\n\nAn authenticated caller whose rules grant READ only on parts of a resource can therefore read the whole resource. In the DPP API, a rule such as `/v1/dpps/*/elements/*`, meant to grant only passport elements, also grants the complete passport whose identifier contains `/elements/`. In the Submodel Repository, AAS Repository and AAS Environment, a rule such as `/submodels/*/submodel-elements/*/attachment`, meant to grant only file attachments, also grants the complete element whose stored idShort contains `%2F`.\n\n\n\nThe issue is fixed in Eclipse BaSyx Go Components v1.1.4.","status":"published","published":"2026-11-13T16:27:04Z","modified":"2026-11-13T16:27:04Z","cvss":[{"version":"4.0","score":6,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-13T20:40:16.3127Z"}],"ghsa":[{"id":"GHSA-gjpm-3829-v3j3","title":"In Eclipse BaSyx Go Components versions up to and including 1.1.3, ABAC-enabled deployments match...","description":"In Eclipse BaSyx Go Components versions up to and including 1.1.3, ABAC-enabled deployments match `ROUTE` access rules against the fully decoded request path, while the router routes on the raw, still encoded path. An encoded slash (`%2F`) inside a path value is a segment separator for the access check but part of the value for the router, so a request can match a narrow `ROUTE` rule while the handler returns a different, larger resource.\n\n\n\nAn authenticated caller whose rules grant READ only on parts of a resource can therefore read the whole resource. In the DPP API, a rule such as `/v1/dpps/*/elements/*`, meant to grant only passport elements, also grants the complete passport whose identifier contains `/elements/`. In the Submodel Repository, AAS Repository and AAS Environment, a rule such as `/submodels/*/submodel-elements/*/attachment`, meant to grant only file attachments, also grants the complete element whose stored idShort contains `%2F`.\n\n\n\nThe issue is fixed in Eclipse BaSyx Go Components v1.1.4.","status":"published","published":"2026-11-13T18:32:30Z","modified":"2026-11-13T18:32:37Z","cvss":[{"version":"4.0","score":6,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"cwes":["CWE-177"],"updated_at":"2026-11-13T18:52:24.500126Z"}],"nvd":[{"id":"CVE-2026-128986","description":"In Eclipse BaSyx Go Components versions up to and including 1.1.3, ABAC-enabled deployments match `ROUTE` access rules against the fully decoded request path, while the router routes on the raw, still encoded path. An encoded slash (`%2F`) inside a path value is a segment separator for the access check but part of the value for the router, so a request can match a narrow `ROUTE` rule while the handler returns a different, larger resource.\n\n\n\nAn authenticated caller whose rules grant READ only on parts of a resource can therefore read the whole resource. In the DPP API, a rule such as `/v1/dpps/*/elements/*`, meant to grant only passport elements, also grants the complete passport whose identifier contains `/elements/`. In the Submodel Repository, AAS Repository and AAS Environment, a rule such as `/submodels/*/submodel-elements/*/attachment`, meant to grant only file attachments, also grants the complete element whose stored idShort contains `%2F`.\n\n\n\nThe issue is fixed in Eclipse BaSyx Go Components v1.1.4.","status":"published","published":"2026-11-13T17:17:28.133Z","modified":"2026-11-13T17:17:28.133Z","cvss":[{"version":"4.0","score":6,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"}],"cwes":["CWE-177","CWE-436","CWE-863"],"updated_at":"2026-11-13T19:37:12.068915Z"}]}}