# CVE-2026-123485: Ground Station missing authorization in get-orbital-sources handler

Source: https://junglewise.ai/threats/cve-2026-123485-ground-station-from-0-6-0-before-0-8-20-does-not-restrict-the  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-06. Updated: 2026-11-06  
License: CC BY 4.0 with a link back

CVE-2026-123485 · Severity: medium · CVSS 6.5 · Published 2026-11-06

Ground Station is a satellite ground station control system that manages orbital data sources and their credentials. An authenticated operator user can exploit a missing access control check to retrieve plaintext usernames, passwords, and API tokens that administrators configured for satellite data sources, potentially compromising external services and systems.

Technologies: [Sgoudelis Ground Station](https://junglewise.ai/threats/technologies/ground-station). Vendors: [Sgoudelis](https://junglewise.ai/threats/vendors/sgoudelis).

## Quick answers

**Is CVE-2026-123485 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-123485 being exploited in the wild.

**How severe is CVE-2026-123485?** Medium severity, with a CVSS score of 6.5, published 6 November 2026.

**Which products and versions are affected?** Sgoudelis Ground Station 0.6.0 through before 0.8.20.

**Is there a fix for CVE-2026-123485?** Yes: fixed in 0.8.20. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-123485 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-123485?** Check whether you run Sgoudelis Ground Station at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 0.8.20

## Technical details

The get-orbital-sources and get-tle-sources Socket.IO handlers fail to enforce admin-only access control, whereas their corresponding write handlers (submit-orbital-sources, edit-orbital-source, delete-orbital-sources) properly restrict access to administrators. An authenticated operator-role user can invoke these read handlers to obtain plaintext credentials stored for basic and token authentication orbital sources, bypassing the intended authorization model.

## Affected products

- sgoudelis Ground Station 0.6.0 through before 0.8.20

## Timeline

- 2026-10-22: disclosed
- 2026-11-06: advisory

## References

- [https://github.com/sgoudelis/ground-station/security/advisories/GHSA-ff27-5cfv-jh69](https://github.com/sgoudelis/ground-station/security/advisories/GHSA-ff27-5cfv-jh69)
- [https://www.vulncheck.com/advisories/ground-station-0.6.0-before-0.8.20-credential-disclosure-via-get-orbital-sources](https://www.vulncheck.com/advisories/ground-station-0.6.0-before-0.8.20-credential-disclosure-via-get-orbital-sources)

## Related threats

- [ground-station authentication bypass in setup.restore](https://junglewise.ai/threats/cve-2026-103244-ground-station-versions-before-0-8-0-contain-an-authentication)
- [Ground Station unauthenticated database destruction via Socket.IO](https://junglewise.ai/threats/cve-2026-53984-ground-station-unauthenticated-database-destruction-via-socket-io)
- [Ground Station unauthenticated SSRF in orbital source configuration](https://junglewise.ai/threats/cve-2026-53983-ground-station-unauthenticated-ssrf-in-orbital-source)
- [Ground Station unauthenticated denial-of-service in Socket.IO](https://junglewise.ai/threats/cve-2026-53985-ground-station-unauthenticated-denial-of-service-in-socket-io)