Access Control Flaw in Eclipse BaSyx Go Components Affecting Submodel Repository

CVE-2026-128790

What is CVE-2026-128790?

In versions of Eclipse BaSyx Go Components up to and including 1.1.2, an access control vulnerability exists in the ABAC-enabled deployments of the Submodel Repository and the AAS Environment. Despite FILTERLIST fragmentation being implemented to restrict access to certain fields, specific endpoints such as GET /submodels/{submodelIdentifier} allow authenticated users with READ access to bypass these restrictions. As a result, sensitive information, including supplementalSemanticIds, can be exposed to unauthorized users. Furthermore, if versioning is enabled, complete historical data can also be retrieved without applying access control filters. This vulnerability has been addressed in version 1.1.3.

References