{"id":"CVE-2026-127102","kind":"vulnerability","aliases":["CVE-2026-127102"],"related":[],"title":"Eclipse BaSyx Go: list route exposes unauthorized Submodel Elements to readers","description":"In Eclipse BaSyx Go Components versions up to and including 1.1.2, ABAC-enabled deployments of the Submodel Repository and the AAS Environment return Submodel Elements that the caller is not authorized to read from `GET /submodels/{submodelIdentifier}/submodel-elements`.\n\n\n\nIf an access rule grants READ on a single Submodel Element through a `$sme` `REFERABLE` object, the list route returns every element of that Submodel, including its value, as soon as one element matches the caller's rules. The single-element route and the full Submodel read enforce the same rule and deny access to the other elements. An authenticated caller with a READ grant for one element of a Submodel can therefore read all other elements of that Submodel.\n\n\n\nThe issue is fixed in Eclipse BaSyx Go Components v1.1.3.","summary":"In Eclipse BaSyx Go Components up to 1.1.2, ABAC-enabled deployments return every element of a Submodel from the list route when a caller has READ on just one element. An authenticated caller can therefore read values they are not authorized to see.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["aas-environment","abac","eclipse-basyx","package","submodel-repository"],"not_affected_if":["default-config","version-1.1.3"],"how_to_check":"- Check the version of Eclipse BaSyx Go Components in use; affected versions are up to and including `1.1.2`.\n- Look for ABAC rules using `$sme` REFERABLE grants on Submodel Repository or AAS Environment deployments.","fix":"- Eclipse BaSyx Go Components: upgrade to `1.1.3`.","status":"open","published_at":"2026-11-13T15:17:44+00:00","first_seen_at":"2026-11-13T15:46:19+00:00","triaged_at":"2026-11-13T15:48:28+00:00","updated_at":"2026-11-13T15:48:28+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-13T15:48:28Z","model":"claude-haiku-5-5","output":{"fix":"- Eclipse BaSyx Go Components: upgrade to `1.1.3`.","reach":"network","title":"Eclipse BaSyx Go: list route exposes unauthorized Submodel Elements to readers","impact":"medium","summary":"In Eclipse BaSyx Go Components up to 1.1.2, ABAC-enabled deployments return every element of a Submodel from the list route when a caller has READ on just one element. An authenticated caller can therefore read values they are not authorized to see.","audience":"businesses","category":"package","nicknames":[],"who_cares":["eclipse-basyx","submodel-repository","aas-environment","abac"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"authenticated callers read unauthorized Submodel Element values","analyst_note":"","how_to_check":"- Check the version of Eclipse BaSyx Go Components in use; affected versions are up to and including `1.1.2`.\n- Look for ABAC rules using `$sme` REFERABLE grants on Submodel Repository or AAS Environment deployments.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["default-config","version-1.1.3"],"who_is_affected":"Deployments of Eclipse BaSyx Go Components up to and including 1.1.2 that have ABAC enabled on the Submodel Repository or AAS Environment. The flaw needs an authenticated account with a READ grant on one Submodel Element. Deployments without ABAC, or on 1.1.3, are not exposed by this flaw.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000764,"input_tokens":4755,"output_tokens":578,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-127102':14A,17A '-2026':13A,16A '/submodel-elements':111C '/submodels':109C '1.1.2':36B,83C 'aa':19B,94C 'aas-environ':18B 'abac':21B,38B,85C 'abac-en':37B,84C 'access':114C,166C 'authent':61B,172C 'author':70B,104C 'basyx':2A,24B,31B,75C,199C 'caller':53B,62B,101C,147C,173C 'compon':33B,77C,201C 'cve':12A,15A 'deni':165C 'deploy':40B,87C 'eclips':1A,23B,30B,74C,198C 'eclipse-basyx':22B 'element':9A,43B,59B,98C,122C,133C,144C,153C,170C,180C,189C 'enabl':39B,86C 'enforc':160C 'environ':20B,95C 'everi':42B,132C 'expos':6A 'fix':196C 'full':157C 'get':108C 'go':3A,32B,76C,200C 'grant':116C,177C 'includ':82C,137C 'issu':194C 'list':4A,49B,129C 'match':145C 'object':127C 'one':58B,143C,179C 'packag':25B 'read':55B,65B,106C,117C,159C,176C,186C 'reader':11A 'refer':126C 'repositori':28B,91C 'return':41B,96C,131C 'rout':5A,50B,130C,154C 'rule':115C,149C,163C 'see':72B 'singl':120C,152C 'single-el':151C 'sme':125C 'soon':141C 'submodel':8A,27B,46B,90C,97C,121C,136C,158C,183C,192C 'submodel-repositori':26B 'submodelidentifi':110C 'therefor':64B,185C 'unauthor':7A 'v1.1.3':202C 'valu':66B,139C 'version':78C","nicknames":[],"mitigations":[],"who_affected":"Deployments of Eclipse BaSyx Go Components up to and including 1.1.2 that have ABAC enabled on the Submodel Repository or AAS Environment. The flaw needs an authenticated account with a READ grant on one Submodel Element. Deployments without ABAC, or on 1.1.3, are not exposed by this flaw.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["aasenvironment","abac","eclipsebasyx","high","package","submodelrepository"],"campaign_type":null,"search_a":"'-127102':14A,17A '-2026':13A,16A 'basyx':2A 'cve':12A,15A 'eclips':1A 'element':9A 'expos':6A 'go':3A 'list':4A 'reader':11A 'rout':5A 'submodel':8A 'unauthor':7A","search_b":"'1.1.2':36B 'aa':19B 'aas-environ':18B 'abac':21B,38B 'abac-en':37B 'authent':61B 'author':70B 'basyx':24B,31B 'caller':53B,62B 'compon':33B 'deploy':40B 'eclips':23B,30B 'eclipse-basyx':22B 'element':43B,59B 'enabl':39B 'environ':20B 'everi':42B 'go':32B 'list':49B 'one':58B 'packag':25B 'read':55B,65B 'repositori':28B 'return':41B 'rout':50B 'see':72B 'submodel':27B,46B 'submodel-repositori':26B 'therefor':64B 'valu':66B","search_c":"'/submodel-elements':111C '/submodels':109C '1.1.2':83C 'aa':94C 'abac':85C 'abac-en':84C 'access':114C,166C 'authent':172C 'author':104C 'basyx':75C,199C 'caller':101C,147C,173C 'compon':77C,201C 'deni':165C 'deploy':87C 'eclips':74C,198C 'element':98C,122C,133C,144C,153C,170C,180C,189C 'enabl':86C 'enforc':160C 'environ':95C 'everi':132C 'fix':196C 'full':157C 'get':108C 'go':76C,200C 'grant':116C,177C 'includ':82C,137C 'issu':194C 'list':129C 'match':145C 'object':127C 'one':143C,179C 'read':106C,117C,159C,176C,186C 'refer':126C 'repositori':91C 'return':96C,131C 'rout':130C,154C 'rule':115C,149C,163C 'singl':120C,152C 'single-el':151C 'sme':125C 'soon':141C 'submodel':90C,97C,121C,136C,158C,183C,192C 'submodelidentifi':110C 'therefor':185C 'v1.1.3':202C 'valu':139C 'version':78C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T15:17:44+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"emo@eclipse.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-127102","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-127102","severity":null,"published_at":"2026-11-13T15:17:44+00:00","modified_at":"2026-11-13T15:17:44+00:00","first_seen_at":"2026-11-13T15:46:19+00:00","fetched_at":"2026-11-13T15:46:19+00:00","note":null}],"documents":[{"id":147259,"url":"https://github.com/eclipse-basyx/basyx-go-components/commit/693e3c72b0dbdaf2c36a1112fde4c77b5d1ead3f","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":147086,"url":"https://github.com/eclipse-basyx/basyx-go-components/releases/tag/v1.1.3","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}