CVE-2026-55547

MediumCVSS 4.3/10Last modified Sep 8, 2026

Description

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs omits SystemPrivilege.ControlAccess checks from IamApi.listRoles, IamApi.getRole, and IamApi.listPrivileges in yamcs-core/src/main/java/org/yamcs/http/api/IamApi.java. Any authenticated account can call GET /api/roles, GET /api/roles/{name}, and GET /api/privileges to enumerate available system privileges and configured role mappings. The disclosure reveals security configuration that can support targeted privilege-escalation attempts. This issue is fixed in versions 5.12.8 and 5.13.2.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-285 CWE-862

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
yamcs	yamcs	< 5.12.8; >= 5.13.0, < 5.13.2

References

Timeline

Published: Aug 28, 2026
Last modified: Sep 8, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-555484.3Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, the PacketsApi.exportPackets endpoint in yamcs-core/src/main/java/org/yamc CVE-2026-555496.5Yamcs is a mission control framework. Prior to 5.9.4, Yamcs reflects an attacker-controlled redirect_uri parameter from GET /auth/authorize CVE-2026-55557.3A weakness has been identified in code-projects Concert Ticket Reservation System 1.0. This affects an unknown part of the file /ConcertTick CVE-2026-555507.1NextCRM is open-source customer relationship management (CRM) software. The CRM product catalog is an organization-wide business object. Nor CVE-2026-555516.5ZAC is an open-source, workflow-based Common Ground component for Dutch municipal case management. Prior to 5.2.0, by-id read endpoints in `CVE-2026-555527.5Yamcs is a mission control framework. Prior to 5.11.13, Yamcs StaticFileHandler.locateFile resolves an unauthenticated request path without CVE-2026-555537.5urllib is an HTTP client for Node.js that supports authentication, redirects, timeouts, and other request features. Prior to 4.9.1 and 2.44.CVE-2026-555547.5Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, the validateLocalUri() method enforces chroot boundaries with a strp CVE-2026-555557.5Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior are vulnerable to a File Existence Oracle attack through the manipulatio CVE-2026-555568.2Rsyslog is a rocket-fast system for log processing. From 8.2110.0 until 8.2604.0, the optional imhttp module's parse_auth_header function in CVE-2026-555578.6browse-mcp is a Playwright-based headless-browser MCP server for MCP-capable agents. Prior to 0.8.2, browser_download writes a fetched respo CVE-2026-555585.9aiosmtplib is an asynchronous SMTP client for use with asyncio. Prior to 5.1.2, SMTPProtocol.start_tls in src/aiosmtplib/protocol.py consume