CVE-2026-128790

{
  "etk_id": "ETK-2026-4391",
  "cve_id": "CVE-2026-128790",
  "display_id": "CVE-2026-128790",
  "ghsa_id": null,
  "euvd_id": "EUVD-2026-125342",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Access-control filtering bypass in Eclipse BaSyx Go Components",
  "summary": "Eclipse BaSyx Go Components through 1.1.2 can fail to enforce ABAC field and object filters on certain individual-read and history responses. An authenticated user with applicable read access may view data that access rules are intended to hide, particularly where ABAC is enabled and, for history endpoints, versioning is enabled.",
  "mitigation": "Upgrade Eclipse BaSyx Go Components to version 1.1.3. Until upgraded, restrict authenticated access to affected read and history interfaces and disable externally unnecessary history access.",
  "vendor": "Eclipse Foundation",
  "product": "Eclipse BaSyx Go Components",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 1.1.3"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "1.1.3"
      ],
      "package_name": "Eclipse BaSyx Go Components",
      "purl": null
    }
  ],
  "cwes": [
    863
  ],
  "cvss_score": 7.1,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 21.180225516666667,
  "t0_at": "2026-11-13T14:12:17.843000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-11-13T14:12:17.843000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-13T14:12:17.843000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-128790"
    }
  }
}