CVE-2026-44595 Yamcs: Unauthorized user enumeration via IAM API endpoints
Authenticated users can enumerate all system accounts and group memberships due to missing privilege checks in Yamcs IAM API endpoints.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-44595?
CVE-2026-44595 is a medium-severity missing authorization vulnerability in yamcs, published on 16 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Yamcs is a mission control framework. Prior to 5.12.7, the IAM API endpoints listUsers, getUser, listGroups, and getGroup in yamcs-core did not enforce the required SystemPrivilege.ControlAccess check in yamcs-core/src/main/java/org/yamcs/http/api/IamApi.java, so any authenticated user, even one with low or no privileges, could enumerate all user accounts in the system including their usernames, superuser status, and group memberships. This issue is fixed in versions 5.12.7 and 5.13.0.
Weakness: CWE-862
Which versions are affected by CVE-2026-44595?
2 open source packages ship an affected version, including org.yamcs:yamcs-core. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.yamcs:yamcs-core Maven | All versions | 5.12.7 |
org.yamcs:yamcs-core Maven | All versions | 5.12.7 |
Products include Spaceapplications Yamcs.
How do I fix CVE-2026-44595?
Upgrade org.yamcs:yamcs-core to 5.12.7 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-44595 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-44595 exists.
Public exploit code: 1 Exploit-DB entry and 1 proofs of concept on GitHub.
Other vulnerabilities in yamcs
- CVE-2026-46562 Yamcs: Remote Code Execution via Mission Database algorithm override
- CVE-2026-44632 Yamcs: Server-Side Code Injection (RCE) via Janino Expression Engine in `JavaExprAlgorithmExecutionFactory`
- CVE-2026-46621 Yamcs: Authenticated Remote Code Execution (RCE) via Jython Algorithm Code Injection
- CVE-2023-45278 Yamcs API Directory Traversal vulnerability
- CVE-2023-45277 Yamcs Path Traversal vulnerability
Sources
Also known as GHSA-p2rj-mrmc-9w29.