Executive brief
Yamcs is a spacecraft mission control software that manages user roles and system privileges through REST APIs. Three API endpoints that list and retrieve role and privilege information lack authorization checks, allowing any authenticated user—even those with minimal permissions—to view the complete security configuration. An attacker with a low-privilege account can discover all administrative capabilities and role-to-privilege mappings, enabling targeted privilege escalation attacks.
Technical details
Three handler methods in IamApi.java (listRoles, getRole, listPrivileges) serve sensitive security metadata without authorization checks, contrary to the ControlAccess privilege requirement applied to adjacent user-management endpoints in the same file. The vulnerable endpoints are GET /api/privileges (retrieves all 31+ system privileges), GET /api/roles (lists all defined roles and their privilege mappings), and GET /api/roles/{name} (retrieves a specific role's configuration). The root cause is missing ctx.checkSystemPrivilege(SystemPrivilege.ControlAccess) calls at the entry of these methods. Attack requires only authentication (any valid user account); network accessibility to the API; no user interaction needed. An attacker can retrieve the server's complete privilege taxonomy and role hierarchy, then cross-reference this information to identify privilege escalation paths. Patches are available in versions 5.13.2 and 5.12.8; the fix adds the missing authorization check to all three methods.
Affected products
- Yamcs Yamcs >=5.13.0, <=5.13.1; <=5.12.7
Timeline
- 2026-07-14: disclosed: Published in GitHub Advisory Database
- 2026-08-28: patched: Patches released in versions 5.13.2 and 5.12.8