CVE-2026-55547: Yamcs missing authorization on role and privilege enumeration endpoints

CVE-2026-55547 · Severity: medium · CVSS 4.3 · Published 2026-08-28

Yamcs is a spacecraft mission control software that manages user roles and system privileges through REST APIs. Three API endpoints that list and retrieve role and privilege information lack authorization checks, allowing any authenticated user—even those with minimal permissions—to view the complete security configuration. An attacker with a low-privilege account can discover all administrative capabilities and role-to-privilege mappings, enabling targeted privilege escalation attacks.

Technologies: org.yamcs:yamcs-core (Maven). Vendors: Maven.

Quick answers

Is CVE-2026-55547 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-55547 being exploited in the wild.
How severe is CVE-2026-55547?
Medium severity, with a CVSS score of 4.3, published 28 August 2026.
Which products and versions are affected?
org.yamcs:yamcs-core (Maven) ECOSYSTEM:introduced=5.13.0,fixed=5.13.2.
Is there a fix for CVE-2026-55547?
Yes. org.yamcs:yamcs-core (Maven): upgrade to 5.13.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55547 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-55547?
Check whether you run org.yamcs:yamcs-core (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.yamcs:yamcs-core (Maven): upgrade to 5.13.2 or later
    # set org.yamcs:yamcs-core to 5.13.2 in your pom.xml or build.gradle

Technical details

Three handler methods in IamApi.java (listRoles, getRole, listPrivileges) serve sensitive security metadata without authorization checks, contrary to the ControlAccess privilege requirement applied to adjacent user-management endpoints in the same file. The vulnerable endpoints are GET /api/privileges (retrieves all 31+ system privileges), GET /api/roles (lists all defined roles and their privilege mappings), and GET /api/roles/{name} (retrieves a specific role's configuration). The root cause is missing ctx.checkSystemPrivilege(SystemPrivilege.ControlAccess) calls at the entry of these methods. Attack requires only authentication (any valid user account); network accessibility to the API; no user interaction needed. An attacker can retrieve the server's complete privilege taxonomy and role hierarchy, then cross-reference this information to identify privilege escalation paths. Patches are available in versions 5.13.2 and 5.12.8; the fix adds the missing authorization check to all three methods.

Affected products

  • Yamcs Yamcs >=5.13.0, <=5.13.1; <=5.12.7

Identifiers

  • CVE-2026-55547
  • GHSA-cvw4-55pp-3hfq

Timeline

  • 2026-07-14: disclosed: Published in GitHub Advisory Database
  • 2026-08-28: patched: Patches released in versions 5.13.2 and 5.12.8

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.