Unauthorized Data Exposure in Eclipse BaSyx Go Components

CVE-2026-127102

What is CVE-2026-127102?

Eclipse BaSyx Go Components versions up to 1.1.2 have an access control flaw in ABAC-enabled deployments whereby authenticated users can gain unauthorized access to Submodel Elements. When a user is granted READ permissions for a single Submodel Element, the system erroneously enables them to read all elements of that Submodel through the list retrieval route. Consequently, a user can potentially exploit this vulnerability to access sensitive information contained within other Submodel Elements. The issue has been addressed in version 1.1.3.

References