CVE-2026-128790
Received Received - Intake

Information Disclosure in Eclipse BaSyx Go Components

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: Eclipse Foundation

Description
In Eclipse BaSyx Go Components versions up to and including 1.1.2, ABAC-enabled deployments of the Submodel Repository and the AAS Environment do not apply an access rule's `FILTERLIST` fragment filters to single Submodel reads. `GET /submodels` removes the fields that a rule's `FILTERLIST` hides, but `GET /submodels/{submodelIdentifier}` and `GET /submodels/{submodelIdentifier}/$metadata` return them unfiltered. An authenticated caller with READ access to a Submodel can therefore read fields that the access rules hide from them, for example `supplementalSemanticIds` keys that name the other parties allowed to read the Submodel. If versioning is enabled (`history.mode` set to `api` or `audit`), `GET /submodels/{submodelIdentifier}/$history` and `GET /shells/{aasIdentifier}/$history` in the Submodel Repository, AAS Repository and AAS Environment return the complete stored version without applying the rule's formula or fragment filters. A caller whose rules grant READ on these routes can read fields that the access rules hide, and Submodels and Asset Administration Shells that the direct read does not return to them at all. The issue is fixed in Eclipse BaSyx Go Components v1.1.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-128790
EUVD
EUVD-2026-125342

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Eclipse Foundation Eclipse BaSyx Go Components From 0 (inc) to 1.1.3 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Eclipse BaSyx Go Components versions up to 1.1.2. When ABAC is enabled, certain endpoints like GET /submodels/{submodelIdentifier} and history reads do not filter data according to access rules. This allows authenticated users with READ access to view fields or entire Submodels they should not be able to access, such as supplementalSemanticIds or historical versions.

Detection Guidance

To detect this vulnerability, check if your Eclipse BaSyx Go Components version is below 1.1.3. Use commands like 'curl -X GET http://<server>/submodels/{submodelIdentifier}' and 'curl -X GET http://<server>/submodels/{submodelIdentifier}/$metadata' to verify if unfiltered data is returned despite ABAC rules. Also test history endpoints with 'curl -X GET http://<server>/submodels/{submodelIdentifier}/$history'.

Compare responses from /submodels and /submodels/{id} endpoints. If the latter returns fields like supplementalSemanticIds that should be hidden, the system is vulnerable.

Impact Analysis

An attacker with READ access could exploit this to read sensitive data like supplementalSemanticIds or entire Submodels that should be restricted. This could lead to unauthorized data exposure, especially in environments like Catena-X where business partner-specific access is critical.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating principles of data minimization and access control required by GDPR and HIPAA. Unauthorized exposure of fields like supplementalSemanticIds or entire Submodels may result in non-compliance with these regulations.

Mitigation Strategies

Upgrade Eclipse BaSyx Go Components to version 1.1.3 or later immediately. Review and update ABAC policies to avoid granting $sme REFERABLE access to restricted callers. Segregate sensitive data into separate submodels if needed.

Disable versioning history mode if not required, or ensure history endpoints are properly secured. Audit access logs for unauthorized read attempts on restricted fields or submodels.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-128790. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...