An authorization bypass in Eclipse BaSyx Go Components allows unauthenticated attackers to perform unauthorized operations by manipulating request paths.

The software exhibits inconsistent path handling between the HTTP router and ABAC middleware (CWE-863, CWE-284). By appending a trailing slash to a request, an attacker can bypass ABAC authorization checks, allowing for unauthorized read, write, or delete operations on protected API routes.

This flaw undermines the core security model of the affected services, potentially exposing sensitive repository data to unauthorized modification or exfiltration. With a CVSS score of 9.8, this vulnerability poses a critical threat to data integrity and system security, as it effectively neutralizes established access control policies.

Immediate Action: Upgrade all deployments of Eclipse BaSyx Go Components to version 1.0.1.

Proactive Monitoring: Review API access logs for anomalous requests featuring trailing slashes or attempts to access restricted endpoints that should be blocked by ABAC.

Compensating Controls: Implement a Web Application Firewall (WAF) to normalize incoming request paths and block requests that attempt to bypass routing security via malformed URL structures.

Public Exploit Available: Unknown.

Given the ease of exploitation and the potential for unauthorized data access, organizations should apply the update to version 1.0.1 without delay. Failure to patch allows attackers to bypass security controls entirely without requiring any authentication.