A missing authorization vulnerability in the Yamcs mission control framework allows authenticated attackers to access sensitive telemetry data and disrupt telecommand handling, posing a significant risk to system integrity.

The application suffers from CWE-862, which is a missing authorization flaw across several API endpoints including IndexesApi and Cop1Api. An authenticated low-privilege user can invoke these functions to bypass security controls, read protected index metadata, and modify link states or system time.

This vulnerability carries a CVSS score of 8.8, reflecting its high potential for severe impact on mission-critical operations. Successful exploitation allows unauthorized users to disclose sensitive telemetry data and disrupt command-and-control links, which could lead to operational downtime, data corruption, or the loss of system control in sensitive environments.

Immediate Action: Upgrade the Yamcs framework to version 5.12.8 or 5.13.2 immediately to implement the missing authorization checks.

Proactive Monitoring: Review access logs for suspicious calls to IndexesApi and Cop1Api endpoints, particularly from accounts with standard or low-level privileges.

Compensating Controls: Implement strict network segmentation and apply role-based access control (RBAC) policies at the API gateway level to restrict access to the affected administrative endpoints.

Public Exploit Available: No (Exploit_available: false)

Given the critical nature of mission control software, organizations must prioritize patching this vulnerability to prevent unauthorized manipulation of telemetry and telecommand links. Administrators should verify their current version and apply the vendor-supplied updates as soon as possible to ensure the security of their operational environment.