Information Disclosure in Yamcs IAM API

Executive Summary

CVE-2026-44595 is a vulnerability in Yamcs versions prior to 5.12.7 where IAM API endpoints listUsers, getUser, listGroups, and getGroup did not enforce required SystemPrivilege.ControlAccess checks. This allowed any authenticated user, even with low or no privileges, to enumerate all user accounts including usernames, superuser status, and group memberships.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your Yamcs instance is running a version prior to 5.12.7 or 5.13.0. Use commands like 'curl -u username:password http://<yamcs-server>/api/listUsers' to test if unauthorized user enumeration is possible. If the endpoint returns user details without proper authorization, the system is vulnerable.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to identify privileged accounts and gather sensitive user information like usernames and group memberships. This could enable targeted attacks such as phishing, privilege escalation, or further exploitation of the system by knowing which accounts have higher privileges.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially violate compliance with GDPR and HIPAA by exposing sensitive user information such as usernames, superuser status, and group memberships to unauthorized users. Unauthorized access to such data may lead to breaches of confidentiality requirements under these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Yamcs to version 5.12.7 or 5.13.0 or later to apply the fix. Ensure the SystemPrivilege.ControlAccess check is enforced for listUsers, getUser, listGroups, and getGroup endpoints. Review user privileges and audit logs for any suspicious activity.

Useful 0 Not Useful 0