CVE-2026-15704

Name of the Vulnerable Software and Affected Versions Eclipse BaSyx Go Components versions prior to 1.0.1

Description An authorization bypass exists in ABAC-enabled deployments due to inconsistent trailing-slash handling between the ABAC middleware and the HTTP router. The shared router uses middleware.StripSlashes, which dispatches requests like GET /shells/ to the GET /shells route. However, the ABAC middleware evaluates the original request path including the trailing slash. If no matching slash-suffixed route is found in the ABAC lookup, the request is passed to the router, which strips the slash and executes the protected handler without the required ABAC authorization decision or query filters. An unauthenticated or unauthorized network attacker can append a trailing slash to protected API routes to perform unauthorized read, create, update, delete, or upload operations. This affects services using the shared router and ABAC middleware, including AAS Repository, Submodel Repository, AAS Registry, Submodel Registry, Concept Description Repository, Discovery, and AAS Environment upload.

Recommendations Update Eclipse BaSyx Go Components to version 1.0.1.