{"id":"CVE-2026-55548","aliases":["EUVD-2026-44960","GHSA-8xjq-pr36-ccgf"],"status":"published","title":"Yamcs: Insecure Direct Object Reference (IDOR) in PacketsApi allows unprivileged users to dump all telemetry packets","description":"Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, the PacketsApi.exportPackets endpoint in yamcs-core/src/main/java/org/yamcs/http/api/PacketsApi.java failed to enforce object-level ReadPacket privileges when a request omitted specific packet names: with an empty name list the ctx.checkObjectPrivileges(ObjectPrivilegeType.ReadPacket, nameSet) call passed over an empty set, no WHERE pname IN filter was applied to the resulting SELECT * FROM tm query, and the onTuple handler streamed every retrieved packet without any per-row authorization check, so a low-privileged or zero-privilege authenticated user could dump the entire raw telemetry packet archive and bypass the role-based access control model. This issue is fixed in versions 5.12.8 and 5.13.2, which enforce per-packet ReadPacket checks in exportPackets.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.0036,"percentile":0.30105,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-284","CWE-862"],"published":"2026-07-16T16:09:35Z","modified":"2026-11-11T02:47:32Z","fixes":[{"ecosystem":"Maven","package":"org.yamcs:yamcs-core","fixed_in":["5.13.2","5.12.8"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.yamcs:yamcs-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.13.0"},{"last_affected":"5.13.1"},{"fixed":"5.13.2"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.yamcs:yamcs-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"5.12.7"},{"fixed":"5.12.8"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.yamcs:yamcs-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.13.0"},{"fixed":"5.13.2"}]}],"versions":["5.13.0","5.13.1"]},{"source":"osv","ecosystem":"Maven","package":"org.yamcs:yamcs-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.12.8"}]}],"versions":["0.29.3","0.30.0","3.0.0","3.1.0","3.1.1","3.1.2","3.2.0","3.2.1","3.2.2","3.3.0","3.3.1","3.4.0","3.4.1","3.4.11","3.4.2","3.4.3","3.4.4","3.4.5","3.4.6","3.4.8","4.0.0","4.0.1","4.1.1","4.1.2","4.10.0","4.10.1","4.10.2","4.10.3","4.10.4","4.10.5","4.10.6","4.10.7","4.10.8","4.10.9","4.2.0","4.2.1","4.2.2","4.3.0","4.3.1","4.4.0","4.4.1","4.4.2","4.5.0","4.6.0","4.6.1","4.6.2","4.6.3","4.7","4.7.1","4.7.3","4.8.0","4.8.1","4.9.0","4.9.1","4.9.2","4.9.3","4.9.4","5.0.0","5.1.0","5.1.1","5.1.2","5.1.3","5.1.4","5.10.0","5.10.1","5.10.10","5.10.11","5.10.12","5.10.2","5.10.3","5.10.4","5.10.5","5.10.6","5.10.7","5.10.8","5.10.9","5.11.0","5.11.1","5.11.10","5.11.11","5.11.12","5.11.13","5.11.2","5.11.3","5.11.4","5.11.5","5.11.6","5.11.7","5.11.8","5.11.9","5.12.0","5.12.1","5.12.2","5.12.3","5.12.4","5.12.5","5.12.6","5.12.7","5.2.0","5.2.1","5.2.2","5.2.3","5.2.4","5.2.5","5.2.6","5.3.0","5.3.1","5.3.2","5.3.3","5.3.4","5.3.5","5.3.6","5.4.0","5.4.1","5.4.2","5.4.3","5.4.4","5.4.5","5.5.0","5.5.1","5.5.2","5.5.3","5.5.4","5.5.5","5.5.6","5.5.7","5.6.0","5.6.1","5.6.2","5.7.0","5.7.1","5.7.10","5.7.11","5.7.12","5.7.13","5.7.2","5.7.3","5.7.4","5.7.5","5.7.6","5.7.7","5.7.8","5.7.9","5.8.0","5.8.1","5.8.2","5.8.3","5.8.4","5.8.5","5.8.6","5.8.7","5.8.8","5.9.0","5.9.1","5.9.10","5.9.11","5.9.12","5.9.2","5.9.3","5.9.4","5.9.5","5.9.6","5.9.7","5.9.8","5.9.8.1","5.9.9"]}],"products":[{"vendor":"spaceapplications","product":"yamcs"},{"vendor":"yamcs","product":"yamcs"}],"references":[{"url":"https://github.com/yamcs/yamcs/security/advisories/GHSA-8xjq-pr36-ccgf","tags":["x_refsource_CONFIRM","exploit","Exploit","Mitigation","Vendor Advisory","advisory","web"]},{"url":"https://github.com/yamcs/yamcs/commit/b566beceba98cc35514b0e1519be126b8c5a0438","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/yamcs/yamcs/commit/c743cc3acf5b5c53ff5181b94eacc21340f70dd9","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.8","tags":["x_refsource_MISC","Release Notes","web"]},{"url":"https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.2","tags":["x_refsource_MISC","Release Notes","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55548","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-8xjq-pr36-ccgf"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55548.json","tags":["advisory"]},{"url":"https://github.com/yamcs/yamcs","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-55548","title":"Yamcs: Insecure Direct Object Reference (IDOR) in PacketsApi allows unprivileged users to dump all telemetry packets","description":"Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, the PacketsApi.exportPackets endpoint in yamcs-core/src/main/java/org/yamcs/http/api/PacketsApi.java failed to enforce object-level ReadPacket privileges when a request omitted specific packet names: with an empty name list the ctx.checkObjectPrivileges(ObjectPrivilegeType.ReadPacket, nameSet) call passed over an empty set, no WHERE pname IN filter was applied to the resulting SELECT * FROM tm query, and the onTuple handler streamed every retrieved packet without any per-row authorization check, so a low-privileged or zero-privilege authenticated user could dump the entire raw telemetry packet archive and bypass the role-based access control model. This issue is fixed in versions 5.12.8 and 5.13.2, which enforce per-packet ReadPacket checks in exportPackets.","status":"published","published":"2026-07-16T16:09:35.505Z","modified":"2026-07-16T18:14:19.081Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-284","CWE-862"],"updated_at":"2026-11-02T14:20:11.925815Z"}],"euvd":[{"id":"EUVD-2026-44960","description":"Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, the PacketsApi.exportPackets endpoint in yamcs-core/src/main/java/org/yamcs/http/api/PacketsApi.java failed to enforce object-level ReadPacket privileges when a request omitted specific packet names: with an empty name list the ctx.checkObjectPrivileges(ObjectPrivilegeType.ReadPacket, nameSet) call passed over an empty set, no WHERE pname IN filter was applied to the resulting SELECT * FROM tm query, and the onTuple handler streamed every retrieved packet without any per-row authorization check, so a low-privileged or zero-privilege authenticated user could dump the entire raw telemetry packet archive and bypass the role-based access control model. This issue is fixed in versions 5.12.8 and 5.13.2, which enforce per-packet ReadPacket checks in exportPackets.","status":"published","published":"2026-07-16T16:09:35Z","modified":"2026-07-16T18:14:19Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T18:19:51.364603Z"}],"ghsa":[{"id":"GHSA-8xjq-pr36-ccgf","title":"Yamcs: Insecure Direct Object Reference (IDOR) in PacketsApi allows unprivileged users to dump all telemetry packets","description":"## Summary\nThe `PacketsApi.exportPackets` endpoint in Yamcs fails to properly enforce object-level privileges (`ReadPacket`) when an API request omits specific packet names. As a result, an attacker with a low-privileged account (or any authenticated user with zero privileges) can dump the entire archive of raw telemetry packets for a Yamcs instance. This leads to a massive Information Disclosure of sensitive mission telemetry, completely bypassing the intended Role-Based Access Control (RBAC) model.\n\n## Vulnerability Details\nIn `yamcs-core/src/main/java/org/yamcs/http/api/PacketsApi.java`, the `exportPackets` method processes requests to export raw packets from the `tm` (telemetry archive) table.\n\n```java\n    @Override\n    public void exportPackets(Context ctx, ExportPacketsRequest request, Observer\u003cHttpBody\u003e observer) {\n        String instance = InstancesApi.verifyInstance(request.getInstance());\n\n        Set\u003cString\u003e nameSet = new HashSet\u003c\u003e(request.getNameList());\n        ctx.checkObjectPrivileges(ObjectPrivilegeType.ReadPacket, nameSet);\n\n        SqlBuilder sqlb = new SqlBuilder(XtceTmRecorder.TABLE_NAME);\n        \n        // ... time filters ...\n\n        if (request.getNameCount() \u003e 0) {\n            sqlb.whereColIn(\"pname\", nameSet);\n        }\n        String sql = sqlb.toString();\n        // ...\n```\nThe method attempts to verify privileges using `ctx.checkObjectPrivileges(ObjectPrivilegeType.ReadPacket, nameSet)`. However, if the `request.getNameList()` is empty (i.e., the attacker does not specify any packet names to filter by), `nameSet` is empty. The `checkObjectPrivileges` method loops over this empty set and successfully passes without throwing a `ForbiddenException`. \n\nSince `request.getNameCount()` is 0, no `WHERE pname IN (...)` filter is added to the SQL query. The resulting `sql` query becomes a `SELECT * FROM tm` (with optional time filters).\n\nFinally, the query is executed and the results are streamed back to the user:\n```java\n        StreamFactory.stream(instance, sql, sqlb.getQueryArguments(), new StreamSubscriber() {\n\n            @Override\n            public void onTuple(Stream stream, Tuple tuple) {\n                if (observer.isCancelled()) {\n                    stream.close();\n                    return;\n                }\n\n                byte[] raw = (byte[]) tuple.getColumn(StandardTupleDefinitions.TM_PACKET_COLUMN);\n                HttpBody body = HttpBody.newBuilder()\n                        .setData(ByteString.copyFrom(raw))\n                        .build();\n                observer.next(body);\n            }\n            // ...\n```\nCrucially, unlike the `streamPackets` or `exportPacket` methods (which explicitly check `ctx.user.hasObjectPrivilege` for each packet retrieved before returning them), the `onTuple` handler in `exportPackets` **blindly streams all retrieved packets to the user without any per-row authorization checks**. \n\nThus, a user who possesses no `ReadPacket` privileges at all can easily bypass authorization and extract all telemetry data from the archive.\n\n## Steps to Reproduce\n1. Start the Yamcs server (e.g., using the `simulation` example) with authentication enforced.\n2. Log in as a low-privileged user (or use their credentials) who does **not** have the `ReadPacket` privilege.\n3. Send an HTTP GET request to the export packets endpoint without specifying any `name` parameters:\n   ```bash\n   curl -v -u low_priv_user:password \"http://localhost:8090/api/archive/simulator:exportPackets\" -o dumped_packets.raw\n   ```\n4. Observe that the server responds with HTTP `200 OK` and streams all raw packets to the response, saving them to `dumped_packets.raw`. \n5. The downloaded file contains raw CCSDS Space Packets (binary telemetry data).\n6. Contrast this with an attempt to fetch a specific packet (or calling `listPackets` for an unauthorized packet), which correctly enforces authorization and rejects the request.\n\n## Impact\nTelemetry packets contain the core mission data, vehicle health status, and sensitive measurements (CCSDS Protocol data). This vulnerability completely breaks the access control model for telemetry data, allowing any authenticated user to exfiltrate all historical telemetry packets from the database. In an aerospace or mission-critical environment, this represents a severe data leak (Massive Information Disclosure) of proprietary or classified spacecraft data.\n\n## Remediation\nEnsure that `exportPackets` enforces the same per-row privilege checks as `streamPackets`. \nUpdate the `onTuple` handler to check the user's privileges before emitting each packet:\n\n```java\n            @Override\n            public void onTuple(Stream stream, Tuple tuple) {\n                if (observer.isCancelled()) {\n                    stream.close();\n                    return;\n                }\n\n                // FIX: Retrieve packet name and check authorization\n                String pname = (String) tuple.getColumn(XtceTmRecorder.PNAME_COLUMN);\n                if (ctx.user.hasObjectPrivilege(ObjectPrivilegeType.ReadPacket, pname)) {\n                    byte[] raw = (byte[]) tuple.getColumn(StandardTupleDefinitions.TM_PACKET_COLUMN);\n                    HttpBody body = HttpBody.newBuilder()\n                            .setData(ByteString.copyFrom(raw))\n                            .build();\n                    observer.next(body);\n                }\n            }\n```\n\n## System Information\n- **Affected Versions:** 5.13.0 (Latest Release), 5.12.x, and current `master` branch.\n- **Tested Revision (master):** `309218c651680f79df11a8d0f8628f7033f98a83` \n- **Vulnerability Type:** Insecure Direct Object Reference (IDOR) / Logical Authorization Bypass\n\n## PoC Images:\n\n- Check version:\n\u003cimg width=\"1157\" height=\"489\" alt=\"image\" src=\"https://github.com/user-attachments/assets/58608222-b76f-4eb4-8e57-423523062992\" /\u003e\n\n- Check privilege of user:\n\u003cimg width=\"1439\" height=\"953\" alt=\"image\" src=\"https://github.com/user-attachments/assets/aa7e55f2-2460-4f24-8b6f-d461d2499a6f\" /\u003e\n\u003cimg width=\"1214\" height=\"224\" alt=\"image\" src=\"https://github.com/user-attachments/assets/e9123ae3-a194-462d-a5ca-2c0b1cc9cc6f\" /\u003e\n\n\n- Exploit:\n\n\n\u003cimg width=\"1728\" height=\"685\" alt=\"image\" src=\"https://github.com/user-attachments/assets/0c7b3099-44d6-4392-bbaa-8e84cc151784\" /\u003e\n\n\u003cimg width=\"1768\" height=\"797\" alt=\"image\" src=\"https://github.com/user-attachments/assets/df4016a5-d460-4611-a34a-8c0d206edd9c\" /\u003e","status":"published","published":"2026-08-28T17:15:01Z","modified":"2026-08-28T17:15:02Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-284","CWE-862"],"updated_at":"2026-11-02T14:41:07.031507Z"}],"nvd":[{"id":"CVE-2026-55548","description":"Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, the PacketsApi.exportPackets endpoint in yamcs-core/src/main/java/org/yamcs/http/api/PacketsApi.java failed to enforce object-level ReadPacket privileges when a request omitted specific packet names: with an empty name list the ctx.checkObjectPrivileges(ObjectPrivilegeType.ReadPacket, nameSet) call passed over an empty set, no WHERE pname IN filter was applied to the resulting SELECT * FROM tm query, and the onTuple handler streamed every retrieved packet without any per-row authorization check, so a low-privileged or zero-privilege authenticated user could dump the entire raw telemetry packet archive and bypass the role-based access control model. This issue is fixed in versions 5.12.8 and 5.13.2, which enforce per-packet ReadPacket checks in exportPackets.","status":"published","published":"2026-07-16T17:16:57.987Z","modified":"2026-07-20T01:29:18.843Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-284","CWE-862"],"updated_at":"2026-11-02T14:12:30.250437Z"}],"osv":[{"id":"CVE-2026-55548","title":"Yamcs: Insecure Direct Object Reference (IDOR) in PacketsApi allows unprivileged users to dump all telemetry packets","description":"Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, the PacketsApi.exportPackets endpoint in yamcs-core/src/main/java/org/yamcs/http/api/PacketsApi.java failed to enforce object-level ReadPacket privileges when a request omitted specific packet names: with an empty name list the ctx.checkObjectPrivileges(ObjectPrivilegeType.ReadPacket, nameSet) call passed over an empty set, no WHERE pname IN filter was applied to the resulting SELECT * FROM tm query, and the onTuple handler streamed every retrieved packet without any per-row authorization check, so a low-privileged or zero-privilege authenticated user could dump the entire raw telemetry packet archive and bypass the role-based access control model. This issue is fixed in versions 5.12.8 and 5.13.2, which enforce per-packet ReadPacket checks in exportPackets.","status":"published","published":"2026-07-16T16:09:35.505Z","modified":"2026-11-11T13:04:53.187577971Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-284","CWE-862"],"updated_at":"2026-11-11T03:22:28.447808Z"},{"id":"GHSA-8xjq-pr36-ccgf","title":"Yamcs: Insecure Direct Object Reference (IDOR) in PacketsApi allows unprivileged users to dump all telemetry packets","description":"## Summary\nThe `PacketsApi.exportPackets` endpoint in Yamcs fails to properly enforce object-level privileges (`ReadPacket`) when an API request omits specific packet names. As a result, an attacker with a low-privileged account (or any authenticated user with zero privileges) can dump the entire archive of raw telemetry packets for a Yamcs instance. This leads to a massive Information Disclosure of sensitive mission telemetry, completely bypassing the intended Role-Based Access Control (RBAC) model.\n\n## Vulnerability Details\nIn `yamcs-core/src/main/java/org/yamcs/http/api/PacketsApi.java`, the `exportPackets` method processes requests to export raw packets from the `tm` (telemetry archive) table.\n\n```java\n    @Override\n    public void exportPackets(Context ctx, ExportPacketsRequest request, Observer\u003cHttpBody\u003e observer) {\n        String instance = InstancesApi.verifyInstance(request.getInstance());\n\n        Set\u003cString\u003e nameSet = new HashSet\u003c\u003e(request.getNameList());\n        ctx.checkObjectPrivileges(ObjectPrivilegeType.ReadPacket, nameSet);\n\n        SqlBuilder sqlb = new SqlBuilder(XtceTmRecorder.TABLE_NAME);\n        \n        // ... time filters ...\n\n        if (request.getNameCount() \u003e 0) {\n            sqlb.whereColIn(\"pname\", nameSet);\n        }\n        String sql = sqlb.toString();\n        // ...\n```\nThe method attempts to verify privileges using `ctx.checkObjectPrivileges(ObjectPrivilegeType.ReadPacket, nameSet)`. However, if the `request.getNameList()` is empty (i.e., the attacker does not specify any packet names to filter by), `nameSet` is empty. The `checkObjectPrivileges` method loops over this empty set and successfully passes without throwing a `ForbiddenException`. \n\nSince `request.getNameCount()` is 0, no `WHERE pname IN (...)` filter is added to the SQL query. The resulting `sql` query becomes a `SELECT * FROM tm` (with optional time filters).\n\nFinally, the query is executed and the results are streamed back to the user:\n```java\n        StreamFactory.stream(instance, sql, sqlb.getQueryArguments(), new StreamSubscriber() {\n\n            @Override\n            public void onTuple(Stream stream, Tuple tuple) {\n                if (observer.isCancelled()) {\n                    stream.close();\n                    return;\n                }\n\n                byte[] raw = (byte[]) tuple.getColumn(StandardTupleDefinitions.TM_PACKET_COLUMN);\n                HttpBody body = HttpBody.newBuilder()\n                        .setData(ByteString.copyFrom(raw))\n                        .build();\n                observer.next(body);\n            }\n            // ...\n```\nCrucially, unlike the `streamPackets` or `exportPacket` methods (which explicitly check `ctx.user.hasObjectPrivilege` for each packet retrieved before returning them), the `onTuple` handler in `exportPackets` **blindly streams all retrieved packets to the user without any per-row authorization checks**. \n\nThus, a user who possesses no `ReadPacket` privileges at all can easily bypass authorization and extract all telemetry data from the archive.\n\n## Steps to Reproduce\n1. Start the Yamcs server (e.g., using the `simulation` example) with authentication enforced.\n2. Log in as a low-privileged user (or use their credentials) who does **not** have the `ReadPacket` privilege.\n3. Send an HTTP GET request to the export packets endpoint without specifying any `name` parameters:\n   ```bash\n   curl -v -u low_priv_user:password \"http://localhost:8090/api/archive/simulator:exportPackets\" -o dumped_packets.raw\n   ```\n4. Observe that the server responds with HTTP `200 OK` and streams all raw packets to the response, saving them to `dumped_packets.raw`. \n5. The downloaded file contains raw CCSDS Space Packets (binary telemetry data).\n6. Contrast this with an attempt to fetch a specific packet (or calling `listPackets` for an unauthorized packet), which correctly enforces authorization and rejects the request.\n\n## Impact\nTelemetry packets contain the core mission data, vehicle health status, and sensitive measurements (CCSDS Protocol data). This vulnerability completely breaks the access control model for telemetry data, allowing any authenticated user to exfiltrate all historical telemetry packets from the database. In an aerospace or mission-critical environment, this represents a severe data leak (Massive Information Disclosure) of proprietary or classified spacecraft data.\n\n## Remediation\nEnsure that `exportPackets` enforces the same per-row privilege checks as `streamPackets`. \nUpdate the `onTuple` handler to check the user's privileges before emitting each packet:\n\n```java\n            @Override\n            public void onTuple(Stream stream, Tuple tuple) {\n                if (observer.isCancelled()) {\n                    stream.close();\n                    return;\n                }\n\n                // FIX: Retrieve packet name and check authorization\n                String pname = (String) tuple.getColumn(XtceTmRecorder.PNAME_COLUMN);\n                if (ctx.user.hasObjectPrivilege(ObjectPrivilegeType.ReadPacket, pname)) {\n                    byte[] raw = (byte[]) tuple.getColumn(StandardTupleDefinitions.TM_PACKET_COLUMN);\n                    HttpBody body = HttpBody.newBuilder()\n                            .setData(ByteString.copyFrom(raw))\n                            .build();\n                    observer.next(body);\n                }\n            }\n```\n\n## System Information\n- **Affected Versions:** 5.13.0 (Latest Release), 5.12.x, and current `master` branch.\n- **Tested Revision (master):** `309218c651680f79df11a8d0f8628f7033f98a83` \n- **Vulnerability Type:** Insecure Direct Object Reference (IDOR) / Logical Authorization Bypass\n\n## PoC Images:\n\n- Check version:\n\u003cimg width=\"1157\" height=\"489\" alt=\"image\" src=\"https://github.com/user-attachments/assets/58608222-b76f-4eb4-8e57-423523062992\" /\u003e\n\n- Check privilege of user:\n\u003cimg width=\"1439\" height=\"953\" alt=\"image\" src=\"https://github.com/user-attachments/assets/aa7e55f2-2460-4f24-8b6f-d461d2499a6f\" /\u003e\n\u003cimg width=\"1214\" height=\"224\" alt=\"image\" src=\"https://github.com/user-attachments/assets/e9123ae3-a194-462d-a5ca-2c0b1cc9cc6f\" /\u003e\n\n\n- Exploit:\n\n\n\u003cimg width=\"1728\" height=\"685\" alt=\"image\" src=\"https://github.com/user-attachments/assets/0c7b3099-44d6-4392-bbaa-8e84cc151784\" /\u003e\n\n\u003cimg width=\"1768\" height=\"797\" alt=\"image\" src=\"https://github.com/user-attachments/assets/df4016a5-d460-4611-a34a-8c0d206edd9c\" /\u003e","status":"published","published":"2026-08-28T17:15:01Z","modified":"2026-08-28T17:30:07.755157121Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-284","CWE-862"],"updated_at":"2026-11-02T15:46:43.123867Z"}]}}