CVE-2026-123485

Name of the Vulnerable Software and Affected Versions Ground Station versions 0.6.0 through 0.8.19

Description An authenticated user with the operator role can access the get-orbital-sources Socket.IO handler, which is also exposed as get-tle-sources. This handler lacks proper restriction to administrators, allowing unauthorized users to retrieve plaintext usernames, passwords, and tokens stored by administrators for basic and token orbital sources.

Recommendations Update Ground Station to version 0.8.20 or later.