CVE-2026-55547

Received Received - Intake

Privilege Enumeration in Yamcs via Unauthorized API Access

Publication date: 2026-08-28

Last updated on: 2026-08-28

Assigner: GitHub, Inc.

Description

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs omits SystemPrivilege.ControlAccess checks from IamApi.listRoles, IamApi.getRole, and IamApi.listPrivileges in yamcs-core/src/main/java/org/yamcs/http/api/IamApi.java. Any authenticated account can call GET /api/roles, GET /api/roles/{name}, and GET /api/privileges to enumerate available system privileges and configured role mappings. The disclosure reveals security configuration that can support targeted privilege-escalation attempts. This issue is fixed in versions 5.12.8 and 5.13.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-08-28

Generated

2026-08-29

AI Q&A

2026-08-29

EPSS Evaluated

N/A

NVD

CVE-2026-55547

EUVD

EUVD-2026-67840

Affected Vendors & Products

Vendor	Product	Version / Range
yamcs	yamcs	to 5.12.8\|end_excluding=5.13.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-285	The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

CVE-2026-55547 is a vulnerability in Yamcs, a mission control framework. It involves missing authorization checks in three IAM API endpoints: GET /api/roles, GET /api/roles/{name}, and GET /api/privileges. These endpoints allowed any authenticated user to enumerate system privileges and role mappings without proper privilege checks.

Detection Guidance

To detect this vulnerability, check if your Yamcs instance is running a vulnerable version (5.13.1 or earlier, or 5.12.7 and earlier). Verify if GET requests to /api/roles, /api/roles/{name}, or /api/privileges return privilege or role data without requiring elevated permissions. Use curl commands like: curl -u username:password http://your-yamcs-server/api/roles or curl -u username:password http://your-yamcs-server/api/privileges. If these requests succeed with low-privilege accounts, the system is vulnerable.

Check Yamcs logs for unauthorized access attempts to these endpoints. Compare your Yamcs version against the fixed versions (5.12.8 or 5.13.2).

Impact Analysis

An attacker with a low-privilege account could retrieve sensitive security metadata, such as all system privileges and role-to-privilege mappings. This information could be used to plan further attacks like privilege escalation or credential theft.

Mitigation Strategies

Upgrade Yamcs to version 5.12.8 or 5.13.2 or later immediately. If upgrading is not possible, apply the patch from commit dcaec5f or c2aec1c to add ControlAccess privilege checks to the affected methods. Restrict network access to Yamcs API endpoints to trusted IPs only.

Review all user accounts with access to Yamcs and ensure they follow the principle of least privilege. Monitor logs for any suspicious activity related to role or privilege enumeration.

Hi! I’m here to help you understand CVE-2026-55547. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70