The vulnerability causes Yamcs WebSocket subscription handlers to bypass the privilege checks that are enforced by their REST counterparts. The missing checks allow a logged‑in user with minimal privileges to receive telemetry packets, algorithm status updates, and mission database change notifications that the user is not authorized to view. This results in the unintended disclosure of sensitive operational data. The weakness is a classic example of missing access control (CWE‑862).

Yamcs versions prior to 5.12.8 and before 5.13.2 are affected. These releases lack the privilege enforcement that newer 5.12.8 and 5.13.2 patches add. Administrators should verify the current deployment against the version list and treat any older build as vulnerable.

The CVSS score of 6.5 denotes moderate severity. No EPSS data is available, so the publicly reported exploitation probability is unknown. The issue is not listed in the CISA KEV catalog, suggesting no confirmed large‑scale exploitation yet. The attack requires an authenticated network connection to a Yamcs instance over WebSocket; the vulnerability is therefore exploitable by any user with an account, provided they request a subscription. The likely vector is remote network access to the WebSocket endpoint, implying that the threat is primarily in controlled site or open internet environments.