A configuration mismatch between the ABAC middleware and the HTTP router in Eclipse BaSyx Go Components allows an attacker to append a trailing slash to a protected API route. The router strips the slash and dispatches the request to a protected handler, while the ABAC middleware still evaluates the original path, missing the intended authorization decision and query filters. This flaw can result in unauthorized read, create, update, delete, or upload operations against any service that enforces ABAC, compromising confidentiality, integrity, and availability. The weakness type is CWE-863, representing an ABAC authorization bypass.

The vulnerability affects ABAC‑enabled deployments of Eclipse BaSyx Go Components version 1.0.0 and earlier. Services that share the affected router and middleware—including the AAS Repository, Submodel Repository, AAS Registry, Submodel Registry, Concept Description Repository, Discovery, and AAS Environment upload—are impacted unless the ABAC middleware or routing configuration has been altered.

The CVSS score of 9.8 rates this flaw as critical and the EPSS score of less than 1% indicates a low but non‑zero probability of exploitation in the wild. It is not currently listed in CISA’s KEV catalog. An unauthenticated or unauthorized network attacker who can send customized HTTP requests could exploit the trailing‑slash handling discrepancy to bypass ABAC policies and perform privileged actions on the affected services.