Yamcs: Unauthorized user enumeration via IAM API endpoints
33Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 4.3epss 1.1%
from disclosure to weapon0 days
Published on NVDJul 16
1st PoCMay 29
exploitation probability
1.1%top 38% of all CVEs
observed exploitation
nono source reports it
2 public exploit(s)
Yamcs is a mission control framework. Prior to 5.12.7, the IAM API endpoints listUsers, getUser, listGroups, and getGroup in yamcs-core did not enforce the required SystemPrivilege.ControlAccess check in yamcs-core/src/main/java/org/yamcs/http/api/IamApi.java, so any authenticated user, even one with low or no privileges, could enumerate all user accounts in the system including their usernames, superuser status, and group memberships. This issue is fixed in versions 5.12.7 and 5.13.0.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected products
yamcs · yamcspublic PoCs found — 2
exploitdbwww.exploit-db.com/exploits/52604unverifiedgithubgithub.com/ex-cal1bur/CVE-2026-44595★ 0⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
References
https://github.com/yamcs/yamcs/commit/0e12b518f103f24681299318a30a460fe4327b88https://github.com/yamcs/yamcs/commit/e90099fba98e96214217c195b6a5b87b5f46e51chttps://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.7https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.0https://github.com/yamcs/yamcs/security/advisories/GHSA-p2rj-mrmc-9w29