{"action":"Upgrade org.yamcs:yamcs-core to 5.12.8 (5.12.x) or 5.13.2 (5.13.x) or later.","affected":[{"fixed":"5.13.2","introduced":"5.13.0"},{"fixed":"5.12.8","introduced":"0"}],"component":"org.yamcs:yamcs-core","cve_ids":["CVE-2026-55548"],"ecosystem":"Maven","epss":0.0036,"exploited":false,"fixed_versions":["5.13.2","5.12.8"],"ghsa_id":"GHSA-8xjq-pr36-ccgf","id":"tcs_01M5N8NQ5XK981DHQFJVY1EYGF","modified_at":"2026-08-28T17:30:07.755157121Z","published_at":"2026-08-28T17:15:01Z","references":["https://osv.dev/vulnerability/GHSA-8xjq-pr36-ccgf","https://github.com/yamcs/yamcs/security/advisories/GHSA-8xjq-pr36-ccgf","https://nvd.nist.gov/vuln/detail/CVE-2026-55548","https://github.com/yamcs/yamcs/commit/b566beceba98cc35514b0e1519be126b8c5a0438","https://github.com/yamcs/yamcs/commit/c743cc3acf5b5c53ff5181b94eacc21340f70dd9","https://github.com/yamcs/yamcs","https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.8","https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.2"],"severity":{"label":"medium","score":4.3},"sources":[{"source":"osv","source_id":"GHSA-8xjq-pr36-ccgf","url":"https://osv.dev/vulnerability/GHSA-8xjq-pr36-ccgf"}],"summary":"Yamcs: Insecure Direct Object Reference (IDOR) in PacketsApi allows unprivileged users to dump all telemetry packets"}