# CVE-2026-44595: Yamcs yamcs-core missing authorization in IAM API endpoints

Source: https://junglewise.ai/threats/cve-2026-44595-yamcs-yamcs-core-missing-authorization-in-iam-api-endpoints  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-16. Updated: 2026-07-16  
License: CC BY 4.0 with a link back

CVE-2026-44595 · Severity: medium · CVSS 4.3 · Published 2026-07-16

Yamcs is a mission control framework used for space missions and satellite operations. A security flaw in its identity management system allows any logged-in user, regardless of their permission level, to view a full list of all other users, their group memberships, and who has administrative (superuser) status. This information could be used by a malicious insider to identify and target high-privileged accounts for further attacks.

Technologies: [org.yamcs:yamcs-core (Maven)](https://junglewise.ai/threats/technologies/org-yamcs-yamcs-core), [Yamcs](https://junglewise.ai/threats/technologies/yamcs). Vendors: [Maven](https://junglewise.ai/threats/vendors/maven), [Yamcs](https://junglewise.ai/threats/vendors/yamcs).

## Quick answers

**Is CVE-2026-44595 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44595 being exploited in the wild.

**How severe is CVE-2026-44595?** Medium severity, with a CVSS score of 4.3, published 16 July 2026.

**Which products and versions are affected?** org.yamcs:yamcs-core (Maven) < 5.12.7, ECOSYSTEM:introduced=0,fixed=5.12.7; Yamcs < 5.12.7, < 5.12.7, < 5.13.0.

**Is there a fix for CVE-2026-44595?** Yes. org.yamcs:yamcs-core (Maven): upgrade to 5.12.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-44595 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-44595?** Check whether you run org.yamcs:yamcs-core (Maven) or Yamcs at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.yamcs:yamcs-core (Maven): upgrade to 5.12.7 or later

  ```sh
  # set org.yamcs:yamcs-core to 5.12.7 in your pom.xml or build.gradle
  ```


## Technical details

A missing authorization check (CWE-862) exists in the yamcs-core component within the IamApi.java file. Specifically, the listUsers, getUser, listGroups, and getGroup API endpoints fail to enforce the 'SystemPrivilege.ControlAccess' check. While some sensitive details were filtered, the core identity information remained exposed to any authenticated user regardless of their assigned privileges. An attacker with low-level access can leverage these endpoints via the network to map the system's user hierarchy and identify privileged targets. The issue is resolved by adding the appropriate privilege checks in versions 5.12.7 and 5.13.0.

## Affected products

- Yamcs yamcs-core < 5.12.7, < 5.13.0

## Identifiers

- CVE-2026-44595
- GHSA-p2rj-mrmc-9w29

## Timeline

- 2026-05-21: patched: Fixes released in versions 5.12.7 and 5.13.0
- 2026-07-16: disclosed: CVE published to NVD

## References

- [https://github.com/yamcs/yamcs/commit/0e12b518f103f24681299318a30a460fe4327b88](https://github.com/yamcs/yamcs/commit/0e12b518f103f24681299318a30a460fe4327b88)
- [https://github.com/yamcs/yamcs/commit/e90099fba98e96214217c195b6a5b87b5f46e51c](https://github.com/yamcs/yamcs/commit/e90099fba98e96214217c195b6a5b87b5f46e51c)
- [https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.7](https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.7)
- [https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.0](https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.0)
- [https://github.com/yamcs/yamcs/security/advisories/GHSA-p2rj-mrmc-9w29](https://github.com/yamcs/yamcs/security/advisories/GHSA-p2rj-mrmc-9w29)

## Related threats

- [Yamcs DOM XSS in Extension Routing](https://junglewise.ai/threats/cve-2026-55566-yamcs-dom-xss-in-extension-routing)
- [Yamcs remote code execution via unescaped StreamSQL LIKE pattern](https://junglewise.ai/threats/cve-2026-55565-yamcs-remote-code-execution-via-unescaped-streamsql-like-pattern)
- [Yamcs remote code execution via YAML injection in instance template](https://junglewise.ai/threats/cve-2026-55559-yamcs-remote-code-execution-via-yaml-injection-in-instance)
- [Yamcs unauthenticated directory traversal](https://junglewise.ai/threats/cve-2026-55552-yamcs-unauthenticated-directory-traversal)
- [Yamcs reflected XSS in authorize endpoint](https://junglewise.ai/threats/cve-2026-55549-yamcs-reflected-xss-in-authorize-endpoint)