The vulnerability arises from missing authorization checks in several Yamcs Core API endpoints, including packet and event index listing, COP‑1 control functions, and simulation time setting. A user with only low‑privilege authentication can read packet and event index metadata, change COP‑1 link state, and alter simulation time without the required ObjectPrivilegeType.ReadPacket or SystemPrivilege.ControlLinks permissions. According to CWE‑862 this constitutes an unauthorized access weakness that compromises both the confidentiality of telemetry metadata and the integrity and availability of mission‑critical control operations.

The affected systems are sites running Yamcs Core API before releases 5.12.8 and 5.13.2. The vendor, Yamcs, issues patched versions 5.12.8 and 5.13.2 that remove the missing checks.

The CVSS score of 8.8 classifies the issue as high severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. An attacker needs authenticated access at a low‑privilege level, meaning an internal user or compromised credentials could exploit the flaw. The exploitation path is straightforward: send API requests to the vulnerable endpoints after authenticating, then obtain metadata or modify system state. No remote code execution or additional privileges are required beyond the existing low‑privilege account.