GHSA-8XJQ-PR36-CCGF Yamcs: Insecure Direct Object Reference (IDOR) in PacketsApi allows unprivileged users to dump all telemetry packets

Summary The PacketsApi.exportPackets endpoint in Yamcs fails to properly enforce object-level privileges ReadPacket when an API request omits specific packet names. As a result, an attacker with a low-privileged account or any authenticated user with zero privileges can dump the entire archive of...

Yamcs: Insecure Direct Object Reference (IDOR) in PacketsApi allows unprivileged users to dump all telemetry packets

Summary The PacketsApi.exportPackets endpoint in Yamcs fails to properly enforce object-level privileges ReadPacket when an API request omits specific packet names. As a result, an attacker with a low-privileged account or any authenticated user with zero privileges can dump the entire archive of...

CVE-2026-55548 Yamcs: Insecure Direct Object Reference (IDOR) in PacketsApi allows unprivileged users to dump all telemetry packets

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, the PacketsApi.exportPackets endpoint in yamcs-core/src/main/java/org/yamcs/http/api/PacketsApi.java failed to enforce object-level ReadPacket privileges when a request omitted specific packet names: with an empty name list the...