https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 14 Nov 2026 07:03:51 +0000 https://db.gcve.eu/vuln/cve-2026-127102 <p><strong>Affected:</strong> Eclipse Foundation Eclipse BaSyx Go Components</p> <p>In Eclipse BaSyx Go Components versions up to and including 1.1.2, ABAC-enabled deployments of the Submodel Repository and the AAS Environment return Submodel Elements that the caller is not authorized to read from `GET /submodels/{submodelIdentifier}/submodel-elements`.</p> <p>If an access rule grants READ on a single Submodel Element through a `$sme` `REFERABLE` object, the list route returns every element of that Submodel, including its value, as soon as one element matches the caller&#39;s rules. The single-element route and the full Submodel read enforce the same rule and deny access to the other elements. An authenticated caller with a READ grant for one element of a Submodel can therefore read all other elements of that Submodel.</p> <p>The issue is fixed in Eclipse BaSyx Go Components v1.1.3.</p> <p><strong>Affected:</strong> Eclipse Foundation Eclipse BaSyx Go Components</p> <p>In Eclipse BaSyx Go Components versions up to and including 1.1.2, ABAC-enabled deployments of the Submodel Repository and the AAS Environment return Submodel Elements that the caller is not authorized to read from `GET /submodels/{submodelIdentifier}/submodel-elements`.</p> <p>If an access rule grants READ on a single Submodel Element through a `$sme` `REFERABLE` object, the list route returns every element of that Submodel, including its value, as soon as one element matches the caller&#39;s rules. The single-element route and the full Submodel read enforce the same rule and deny access to the other elements. An authenticated caller with a READ grant for one element of a Submodel can therefore read all other elements of that Submodel.</p> <p>The issue is fixed in Eclipse BaSyx Go Components v1.1.3.</p> https://db.gcve.eu/vuln/cve-2026-127102