Authorization Bypass in Eclipse BaSyx Go Components Affecting Multiple Services

CVE-2026-15704

What is CVE-2026-15704?

The Eclipse BaSyx Go Components, specifically versions up to 1.0.0, are susceptible to an authorization bypass issue due to inconsistent handling of trailing slashes between the ABAC middleware and the HTTP router. When requests are made to protected API routes with a trailing slash, they can be incorrectly routed to handlers without the necessary ABAC authorization check. This flaw allows unauthorized attackers to potentially perform operations that should normally be restricted, including read, create, update, delete, or upload actions, based on the specific ABAC deployment and exposed components.

References