This vulnerability stems from missing authorization checks on the endpoints that list roles, role details, and privileges in the Yamcs mission‑control framework. Any authenticated user can invoke the GET /api/roles, /api/roles/{name}, and /api/privileges calls, which return the full set of system privileges and the configuration of role mappings. The disclosure of this configuration provides an attacker with detailed knowledge of the organization’s privilege structure, making subsequent privilege‑escalation attempts more focused and likely to succeed.

The issue affects the Yamcs product supplied by the vendor yamcs:yamcs. All releases prior to 5.12.8 and 5.13.2 are vulnerable. The fix is incorporated in the 5.12.8 and 5.13.2 releases; older versions must therefore be updated to eliminate the missing authorization logic.

The CVSS score of 4.3 places the vulnerability in the low‑to‑moderate range, and it is not listed in the CISA KEV catalog. The EPSS score is unknown, but the attack requires only authentication and poses no arbitrary code execution risk. An attacker who already has credentials can therefore learn the entire privilege structure, which could aid in later targeted attacks. While the likelihood of exploitation is not high without authorized access, the potential impact on confidentiality and the facilitation of privilege escalation justify prompt remediation.