Executive brief
Yamcs is a space mission control software that manages telemetry and command operations. Three WebSocket subscription handlers omit permission checks that the REST API enforces, allowing authenticated users with restricted roles to subscribe and receive sensitive mission data they should not access—including raw binary telemetry packets, algorithm status updates, and database changes. This is a privilege escalation flaw that could expose confidential mission operations data to authorized but limited-role users.
Technical details
This vulnerability stems from missing authorization checks (CWE-862) in three WebSocket subscription handlers: PacketsApi.subscribePackets (missing ReadPacket check), ProcessingApi.subscribeAlgorithmStatus (missing ReadAlgorithm check), and MdbOverrideApi.subscribeMdbChanges (missing GetMissionDatabase check). The REST API endpoints enforce these checks via checkObjectPrivileges() and similar mechanisms, but the corresponding WebSocket handlers do not. An authenticated attacker (PR:L per CVSS) with a narrow role can subscribe over the network (AV:N, AC:L, UI:N) to receive data the system's authorization model forbids, bypassing privilege scopes. The fix is to bring WebSocket handlers into parity with REST counterparts by adding the declarative privilege checks. Patches are available: 5.12.8 and 5.13.2.
Affected products
- Yamcs Yamcs 5.12.7 and earlier, 5.13.0 to 5.13.1
Timeline
- 2026-08-28: disclosed
- 2026-07-14: patched: Patches released for versions 5.12.8 and 5.13.2
References
- https://api.github.com/users/cipher-creator
- https://github.com/cipher-creator
- https://api.github.com/users/cipher-creator/gists%7B/gist_id%7D
- https://api.github.com/users/cipher-creator/repos
- https://avatars.githubusercontent.com/u/249282395?v=4
- https://api.github.com/users/cipher-creator/events%7B/privacy%7D