Yamcs is a mission control framework. Prior to version 5.12.7, the IAM API endpoints listUsers, getUser, listGroups, and getGroup in the yamcs-core component did not enforce the required SystemPrivilege.ControlAccess check, so any authenticated user, even one with low or no privileges, could enumerate all user accounts in the system, including their usernames, superuser status, and group memberships. This weakness is identified as CWE‑862 and was fixed in releases 5.12.7 and 5.13.0.

Yamcs mission-control framework, versions prior to 5.12.7, on any deployment using the yamcs-core component that exposes the IAM endpoints. The fix was applied in releases 5.12.7 and 5.13.0.

The CVSS score of 4.3 indicates a low severity. The EPSS score is < 1%, indicating a very low but measurable probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog, suggesting no widely known exploitation. The attack requires just authentication (any user can log in) and then a simple HTTP call to the IAM endpoints; there is no privilege escalation or arbitrary code execution involved. The main risk is that compromised or low‑privileged accounts can gather information about all system users, which can aid future attacks, but the impact remains limited to information disclosure.