Another vulnerability in the YAMCS platform allowed any authenticated user, regardless of their privilege level, to list every account in the system and identify which ones had superuser access.
The issue (CVE-2026-44595) was a broken access control in the IAM API endpoints. The listUsers, getUser, listGroups, and getGroup endpoints didn’t enforce the SystemPrivilege.ControlAccess check. That meant even a low-privilege user could enumerate all usernames, their superuser status, and group memberships across the entire deployment.
The root cause was visible in the code. While the createUser endpoint correctly called ctx.checkSystemPrivilege(SystemPrivilege.ControlAccess), the read endpoints simply skipped that check. The listUsers function read the current user“s ControlAccess status but never explicitly denied access to others. The fix adds explicit ControlAccess checks to all four enumeration endpoints.
This vulnerability is particularly concerning in environments where YAMCS manages access to critical infrastructure. Knowing which accounts have superuser status gives attackers a precise target list. If you operate a YAMCS instance and haven’t upgraded to 5.12.7 yet, prioritize that update.
