CVE-2026-127102: Infoleak
In Eclipse BaSyx Go Components versions up to and including 1.1.2, ABAC-enabled deployments of the Submodel Repository and the AAS Environment return Submodel Elements that the caller is not authorized to read from GET /submodels/{submodelIdentifier}/submodel-elements.
If an access rule grants READ on a single Submodel Element through a $sme REFERABLE object, the list route returns every element of that Submodel, including its value, as soon as one element matches the caller's rules. The single-element route and the full Submodel read enforce the same rule and deny access to the other elements. An authenticated caller with a READ grant for one element of a Submodel can therefore read all other elements of that Submodel.
The issue is fixed in Eclipse BaSyx Go Components v1.1.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Eclipse BaSyx Go Componentsto a version that resolves this vulnerability.Fixed in 1.1.3
Event History
Frequently Asked Questions
Which deployments are affected?
Affected deployments use Eclipse BaSyx Go Components through version 1.1.2, have ABAC enabled, and expose either the Submodel Repository or the AAS Environment. The issue concerns Submodels containing multiple Submodel Elements with element-level READ rules.
What access does an attacker need?
The caller must be authenticated and have a READ grant for at least one Submodel Element in the target Submodel through a $sme REFERABLE access-rule object. No additional user interaction is required.
Which request exposes unauthorized elements?
The affected request is GET /submodels/{submodelIdentifier}/submodel-elements. When one element matches the caller's rule, this list route can return every element in that Submodel, including values the caller is not authorized to read.
Are other read routes affected in the same way?
No. The single-element route and a full Submodel read enforce the element-level rule and deny access to elements for which the caller lacks authorization.
How can the issue be remediated?
Upgrade to Eclipse BaSyx Go Components v1.1.3. If upgrading is not immediately possible, avoid allowing callers with access to only selected Submodel Elements to use the affected list route.