CVE-2026-15704

CWE-863: ABAC authorization bypass via trailing slash route normalization in Eclipse BaSyx Go Components

No known exploitation. EPSS puts it in the 51st percentile. Fixed in 1.0.1.

CVSS 3.19.8Critical EPSS percentile51st0.7% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known Fix1.0.1Upgrade to this build

Published 2026-07-24Updated 2026-07-30Sources: CVE.org, NVD

NVD CVE.org

What to do

Find your product and version, then upgrade to the build on the right.

Eclipse Foundation Eclipse BaSyx Go ComponentsAffected: < 1.0.1Upgrade to: 1.0.1Stated by: CVE record

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check which version of Eclipse BaSyx Go Components your service is running (confirm it is up to and including 1.0.0).
Confirm ABAC is enabled in your BaSyx deployment and that the vulnerable shared router/middleware setup is in use.
Upgrade Eclipse BaSyx Go Components to 1.0.1 (this is the fixed version).
After upgrading, test a protected endpoint with and without a trailing slash to ensure requests are consistently blocked by ABAC when they should be.

Usually a quick update

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

In Eclipse BaSyx Go Components versions up to and including 1.0.0, ABAC-enabled deployments are vulnerable to an authorization bypass caused by inconsistent trailing-slash handling between the ABAC middleware and the HTTP router. The shared router configuration used Chi's `middleware.StripSlashes`, so a request such as `GET /shells/` was dispatched to the registered `GET /shells` route. However, the ABAC middleware evaluated the original request path including the trailing slash. If ABAC route lookup did not find a matching slash-suffixed route, the request was passed onward and the router then stripped the slash and executed the protected handler without the intended ABAC authorization decision and without the expected ABAC query filters. An unauthenticated or unauthorized network attacker could append a trailing slash to protected API routes to reach handlers that should have been denied by ABAC policy. Depending on the exposed component, HTTP method, and deployed policy, this could allow unauthorized read, create, update, delete, or upload operations. The issue affects ABAC-enabled deployments of services that use the shared router and ABAC middleware, including AAS Repository, Submodel Repository, AAS Registry, Submodel Registry, Concept Description Repository, Discovery, AAS Environment upload, and related services. The issue is fixed in Eclipse BaSyx Go Components v1.0.1.

In plain language

Written by AI from the record

Eclipse BaSyx Go Components (up to 1.0.0) can be tricked into skipping its access rules if someone adds a trailing slash to certain API URLs, letting an attacker read or change data without permission—small businesses using this software should act.

Unauthenticated ABAC authorization can be bypassed in Eclipse BaSyx Go Components (versions up to 1.0.0) due to inconsistent trailing-slash route normalization between the ABAC middleware and the HTTP router, allowing protected endpoints to be reached without the intended ABAC decision and query filters.

If you're affected

Unauthorized data access
Unauthorized create/update/delete
Unauthorized uploads
Total service takeover risk

What is it

This vulnerability is like having a building guard who checks one door label, but the attacker slips in through a “different-looking” door that still leads to the same room. Specifically, BaSyx can treat URLs with a trailing slash differently between its access-control rules and the web routing, which can cause the access rules to be skipped. If your setup exposes BaSyx APIs with ABAC enabled, an attacker may be able to access or modify resources they shouldn’t.

Who is affected

You are affected if you run Eclipse BaSyx Go Components in a configuration where ABAC is enabled, using the shared router and ABAC middleware as described, and your deployed BaSyx Go Components version is up to 1.0.0.

This matters most if your BaSyx HTTP APIs are reachable over the network (reachable in default configuration). The risk is only present when an attacker can reach the endpoints and use the trailing-slash trick (it does not require a login or user interaction).

How urgent is it

This should be treated as urgent because an attacker can bypass authorization over the network and access or modify protected endpoints without any login. The traffic-light level is AMBER: it’s a serious, real-world authorization bypass in commonly used ABAC-enabled setups, even though public exploit code is not on record.

What to do — in detail

Confirm exposure

Identify your deployed version of Eclipse BaSyx Go Components. If it is up to and including 1.0.0, you are in the affected range.
Verify ABAC is enabled in your BaSyx deployment. This issue is specifically for ABAC-enabled setups.
Confirm reachability: determine whether the BaSyx HTTP APIs are reachable from external networks (the findings state it’s reachable in default configuration).

Upgrade to the fixed version

Upgrade Eclipse BaSyx Go Components to 1.0.1 (fixed version).
After upgrading, validate enforcement by making requests to a protected API route both as:
- /some-protected-route and
- /some-protected-route/
Ensure that ABAC consistently blocks unauthorized actions and that the same ABAC decision applies regardless of trailing slash.

If you cannot upgrade immediately

Use your environment controls to reduce exposure while you plan the upgrade:
- Restrict network access so the BaSyx APIs are not reachable from the public internet.
- Limit access to only approved internal networks or systems.
(This addresses the “reachable from the network” condition noted in the findings; it does not replace upgrading to 1.0.1.)

What to monitor after the fix

Watch for unexpected requests to protected endpoints (especially differing paths with/without a trailing slash) and confirm the ABAC enforcement behavior matches your policy expectations.

CISA KEV timing

This CVE is not listed in the CISA KEV catalog per the provided findings.

Technical context

Severity is critical by scoring and includes full impact potential (read, create, update, delete, and upload). The underlying weakness is an authorization bypass caused by inconsistent trailing-slash handling between ABAC middleware and the HTTP router in Eclipse BaSyx Go Components versions up to and including 1.0.0.

Mechanism: the router normalizes paths (e.g., stripping slashes) so the request reaches the correct route, but the ABAC middleware evaluates authorization using the original request path including the trailing slash. When ABAC route lookup fails to match the slash-suffixed path, the request is passed onward and reaches the handler without the intended ABAC decision and without expected ABAC query filters.

Attack vector and prerequisites from findings: network-reachable, no authentication required, no user interaction, and ABAC must be enabled with the vulnerable shared router/middleware setup. Affected component families include AAS Repository, Submodel Repository, AAS Registry, Submodel Registry, Concept Description Repository, Discovery, AAS Environment upload, and related services, as long as they use the described ABAC-enabled setup.

Exploitation status: no public exploit code on record; KEV is not listed. This aligns with an AMBER urgency level (serious authorization bypass, but no confirmed KEV exploitation in the provided findings).

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS51st

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.7% chance of exploitation activity in the next 30 days, which ranks it in the 51st percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

6 events over 6 days, from the signal feeds we watch.

2026-07-30Record updated
2026-07-24Publishedweakness classified, att&ck mapped, record updated, record updated

Affected products

Eclipse Foundationoss-project · DE
- Eclipse BaSyx Go ComponentsMixedOSS Libraries / generic-library

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Scored 9.8 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable