CVE-2026-44595

Name of the Vulnerable Software and Affected Versions Yamcs versions prior to 5.12.7

Description In the yamcs-core component, the IAM API endpoints 'listUsers', 'getUser', 'listGroups', and 'getGroup' fail to enforce the SystemPrivilege.ControlAccess check. This broken access control allows any authenticated user, regardless of their privilege level, to enumerate all user accounts within the system. The exposed information includes usernames, superuser status, and group memberships.

Recommendations Update to version 5.12.7 or 5.13.0. As a temporary workaround, restrict access to the 'listUsers', 'getUser', 'listGroups', and 'getGroup' API endpoints to minimize the risk of information disclosure.