Executive brief
Yamcs is a mission control framework used for space missions and satellite operations. A security flaw in its identity management system allows any logged-in user, regardless of their permission level, to view a full list of all other users, their group memberships, and who has administrative (superuser) status. This information could be used by a malicious insider to identify and target high-privileged accounts for further attacks.
Technical details
A missing authorization check (CWE-862) exists in the yamcs-core component within the IamApi.java file. Specifically, the listUsers, getUser, listGroups, and getGroup API endpoints fail to enforce the 'SystemPrivilege.ControlAccess' check. While some sensitive details were filtered, the core identity information remained exposed to any authenticated user regardless of their assigned privileges. An attacker with low-level access can leverage these endpoints via the network to map the system's user hierarchy and identify privileged targets. The issue is resolved by adding the appropriate privilege checks in versions 5.12.7 and 5.13.0.
Affected products
- Yamcs yamcs-core < 5.12.7, < 5.13.0
Timeline
- 2026-05-21: patched: Fixes released in versions 5.12.7 and 5.13.0
- 2026-07-16: disclosed: CVE published to NVD
References
- https://github.com/yamcs/yamcs/commit/0e12b518f103f24681299318a30a460fe4327b88
- https://github.com/yamcs/yamcs/commit/e90099fba98e96214217c195b6a5b87b5f46e51c
- https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.7
- https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.0
- https://github.com/yamcs/yamcs/security/advisories/GHSA-p2rj-mrmc-9w29