Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-15704— CWE-863: ABAC authorization bypass via trailing slash route normalization in Eclipse BaSyx Go Components

Quick assessment

Affected
Eclipse Foundation Eclipse BaSyx Go Components
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Eclipse Eclipse BaSyx Go Components是美国Eclipse基金会开源的一套基于Go语言的组件框架。 Eclipse BaSyx Go Components 1.0.0及之前版本存在安全漏洞，该漏洞源于ABAC中间件和HTTP路由器之间存在不一致的尾随斜杠处理，可能导致未经身份验证或未授权的网络攻击者通过向受保护的API路由添加尾随斜杠，绕过授权访问受保护的处理器，从而执行未经授权的读取、创建、更新、删除或上传操作。

CVSS 9.8 · Critical EPSS 0.46% · P40

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

VendorProduct Version RangeStatus
Eclipse Foundation Eclipse BaSyx Go Components < 1.0.1 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-15704

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
CWE-863: ABAC authorization bypass via trailing slash route normalization in Eclipse BaSyx Go Components
Source: CVE Program / CVE List V5
Vulnerability Description
In Eclipse BaSyx Go Components versions up to and including 1.0.0, ABAC-enabled deployments are vulnerable to an authorization bypass caused by inconsistent trailing-slash handling between the ABAC middleware and the HTTP router. The shared router configuration used Chi's `middleware.StripSlashes`, so a request such as `GET /shells/` was dispatched to the registered `GET /shells` route. However, the ABAC middleware evaluated the original request path including the trailing slash. If ABAC route lookup did not find a matching slash-suffixed route, the request was passed onward and the router then stripped the slash and executed the protected handler without the intended ABAC authorization decision and without the expected ABAC query filters. An unauthenticated or unauthorized network attacker could append a trailing slash to protected API routes to reach handlers that should have been denied by ABAC policy. Depending on the exposed component, HTTP method, and deployed policy, this could allow unauthorized read, create, update, delete, or upload operations. The issue affects ABAC-enabled deployments of services that use the shared router and ABAC middleware, including AAS Repository, Submodel Repository, AAS Registry, Submodel Registry, Concept Description Repository, Discovery, AAS Environment upload, and related services. The issue is fixed in Eclipse BaSyx Go Components v1.0.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不正确
Source: CVE Program / CVE List V5
Vulnerability Title
Eclipse BaSyx Go Components 处理逻辑错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Eclipse Eclipse BaSyx Go Components是美国Eclipse基金会开源的一套基于Go语言的组件框架。 Eclipse BaSyx Go Components 1.0.0及之前版本存在安全漏洞，该漏洞源于ABAC中间件和HTTP路由器之间存在不一致的尾随斜杠处理，可能导致未经身份验证或未授权的网络攻击者通过向受保护的API路由添加尾随斜杠，绕过授权访问受保护的处理器，从而执行未经授权的读取、创建、更新、删除或上传操作。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Eclipse Foundation Eclipse BaSyx Go Components 0 ~ 1.0.1 -

II. Public POCs for CVE-2026-15704

# POC Description Source Link Shenlong Link
AI-Generated POC Premium
Qwen3.6-35B-A3B · 6920 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month

III. Intelligence Information for CVE-2026-15704

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-15704 (1)

Vendor Advisories for CVE-2026-15704 (1)

Vendor Pages for CVE-2026-15704 (1)

Other References for CVE-2026-15704 (1)

IV. Related Vulnerabilities

Same vendor: Eclipse Foundation
Same weakness: CWE-863