CVE-2026-128986

Eclipse BaSyx Go Components versions up to and including 1.1.3 are vulnerable to an authorization bypass due to an interpretation conflict in how ABAC-enabled deployments handle URL encoding. The system matches ROUTE access rules against a fully decoded request path, but the router processes the ...

CVE-2026-127102

Eclipse BaSyx Go Components versions up to and including 1.1.2 are vulnerable to an incorrect authorization issue in ABAC-enabled deployments of the Submodel Repository and the AAS Environment. The vulnerability exists because the GET /submodels/{submodelIdentifier}/submodel-elements list route i...

EUVD-2026-125345

In Eclipse BaSyx Go Components versions up to and including 1.1.2, ABAC-enabled deployments of the Submodel Repository and the AAS Environment return Submodel Elements that the caller is not authorized to read from GET /submodels/submodelIdentifier/submodel-elements. If an access rule grants READ...

CVE-2026-128790

Eclipse BaSyx Go Components versions up to and including v1.1.2 contain a vulnerability where ABAC-enabled deployments of the Submodel Repository and the AAS Environment fail to apply FILTERLIST fragment filters during single Submodel reads. Specifically, while GET /submodels correctly filters fi...

EUVD-2026-125342

In Eclipse BaSyx Go Components versions up to and including 1.1.2, ABAC-enabled deployments of the Submodel Repository and the AAS Environment do not apply an access rule's FILTERLIST fragment filters to single Submodel reads. GET /submodels removes the fields that a rule's FILTERLIST hides, but...