CVE-2026-44595mediumCWE-862

CVE-2026-44595: medium-severity vulnerability in yamcs

Yamcs: Unauthorized user enumeration via IAM API endpoints

Published · Updated

33Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 4.3epss 1.1%
from disclosure to weapon0 days
Published on NVDJul 16
1st PoCMay 29
exploitation probability
1.1%top 36% of all CVEs
observed exploitation
nono source reports it
2 public exploit(s)
Yamcs is a mission control framework. Prior to 5.12.7, the IAM API endpoints listUsers, getUser, listGroups, and getGroup in yamcs-core did not enforce the required SystemPrivilege.ControlAccess check in yamcs-core/src/main/java/org/yamcs/http/api/IamApi.java, so any authenticated user, even one with low or no privileges, could enumerate all user accounts in the system including their usernames, superuser status, and group memberships. This issue is fixed in versions 5.12.7 and 5.13.0.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected products
yamcs · yamcs
public PoCs found — 2
exploitdbwww.exploit-db.com/exploits/52604unverifiedgithubgithub.com/ex-cal1bur/CVE-2026-44595★ 0
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — yamcs

In the same product, most dangerous first.

CVE-2026-44596MEDIUMYamcs: No Rate Limiting on Authentication EndpointEPSS 2.1%CVE-2026-55552HIGHYamcs: Unauthenticated Directory TraversalEPSS 1.7%CVE-2026-55549MEDIUMYamcs: Reflected XSS in the URL of the Authorize EndpointEPSS 1.3%CVE-2026-46621CRITICALYamcs: Authenticated Remote Code Execution (RCE) via Jython Algorithm Code InjectionEPSS 1.1%CVE-2026-44632CRITICALYamcs: Server-Side Code Injection (RCE) via Janino Expression Engine in `JavaExprAlgorithmExecutionFactory`EPSS 1.1%CVE-2026-42568MEDIUMYamcs Vulnerable to LDAP Injection in LdapAuthModuleEPSS 1.0%
References
https://github.com/yamcs/yamcs/commit/0e12b518f103f24681299318a30a460fe4327b88https://github.com/yamcs/yamcs/commit/e90099fba98e96214217c195b6a5b87b5f46e51chttps://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.7https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.0https://github.com/yamcs/yamcs/security/advisories/GHSA-p2rj-mrmc-9w29