Access Control Flaw in Eclipse BaSyx Go Components Exposing Sensitive Data

CVE-2026-128986

What is CVE-2026-128986?

Eclipse BaSyx Go Components versions up to and including 1.1.3 contain a significant access control misconfiguration. This issue arises from the ABAC-enabled deployments which inconsistently handle encoded request paths. While access rules match against a decoded path, the router processes the raw, still encoded path, leading to unauthorized access. For instance, an authenticated user with restricted READ access on part of a resource can mistakenly access the entire resource. This vulnerability allows certain access rules to unintentionally grant permissions beyond intended limits, affecting multiple repositories like the Submodel Repository and AAS Environment. The vulnerability is resolved in version 1.1.4 of the Eclipse BaSyx Go Components.

References