The vulnerability is an insecure direct object reference in the PacketsApi.exportPackets endpoint, which allows a low‑privilege or zero‑privilege authenticated user to retrieve the entire telemetry packet archive. When the request omits the packet name list, the endpoint bypasses the per‑object ReadPacket permission checks, streams every packet returned by the database query, and provides full access to the raw data of potentially sensitive or mission‑critical telemetry information.

The issue exists in Yamcs versions prior to 5.12.8 and 5.13.2. Users running yamcs 5.12.7 or earlier, or yamcs 5.13.1 or earlier, are susceptible; later releases have the per‑packet privilege checks in place.

The CVSS score of 4.3 indicates a moderate severity. An exploitation, and the vulnerability is not listed in the CISA KEV catalog, suggesting no widely known exploits yet. The EPSS score is less than 1%, indicating a low probability of exploitation in the wild. However, the attack requires only authenticated access with low privileges and relies on an API that is otherwise publicly documented, making it readily exploitable for an internal attacker or someone with legitimate user credentials but limited access rights. The lack of a filter on the database query means that once the endpoint is called, the attacker mission data.