---
id: "CVE-2026-127102"
page: "https://infrastack.ai/live/CVE-2026-127102"
kind: "vulnerability"
aliases: ["CVE-2026-127102"]
title: "Eclipse BaSyx Go: list route exposes unauthorized Submodel Elements to readers"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["aas-environment", "abac", "eclipse-basyx", "package", "submodel-repository"]
not_affected_if: ["default-config", "version-1.1.3"]
published_at: "2026-11-13T15:17:44+00:00"
first_seen_at: "2026-11-13T15:46:19+00:00"
updated_at: "2026-11-13T15:48:28+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-127102", "first_seen_at": "2026-11-13T15:46:19+00:00"}]
exploit_sources: []
---

# Eclipse BaSyx Go: list route exposes unauthorized Submodel Elements to readers

Link for people: https://infrastack.ai/live/CVE-2026-127102 (this .md is for agents)

In Eclipse BaSyx Go Components up to 1.1.2, ABAC-enabled deployments return every element of a Submodel from the list route when a caller has READ on just one element. An authenticated caller can therefore read values they are not authorized to see.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the version of Eclipse BaSyx Go Components in use; affected versions are up to and including `1.1.2`.
- Look for ABAC rules using `$sme` REFERABLE grants on Submodel Repository or AAS Environment deployments.

## Fix

- Eclipse BaSyx Go Components: upgrade to `1.1.3`.

## Timeline

- 2026-11-13T15:46:19+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-127102

## Documents

- [fix] Patch: github.com https://github.com/eclipse-basyx/basyx-go-components/commit/693e3c72b0dbdaf2c36a1112fde4c77b5d1ead3f
- [fix] Release notes: github.com https://github.com/eclipse-basyx/basyx-go-components/releases/tag/v1.1.3

## From the sources

In Eclipse BaSyx Go Components versions up to and including 1.1.2, ABAC-enabled deployments of the Submodel Repository and the AAS Environment return Submodel Elements that the caller is not authorized to read from `GET /submodels/{submodelIdentifier}/submodel-elements`.



If an access rule grants READ on a single Submodel Element through a `$sme` `REFERABLE` object, the list route returns every element of that Submodel, including its value, as soon as one element matches the caller's rules. The single-element route and the full Submodel read enforce the same rule and deny access to the other elements. An authenticated caller with a READ grant for one element of a Submodel can therefore read all other elements of that Submodel.



The issue is fixed in Eclipse BaSyx Go Components v1.1.3.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_