Authorization bypass in Eclipse BaSyx Go Components via trailing slash (CVE-2026-15704)

Eclipse BaSyx Go Components contains an authorization bypass in ABAC-enabled deployments caused by inconsistent trailing-slash handling between the ABAC middleware and the HTTP router. The ABAC middleware evaluates the original request path including a trailing slash, but if no matching route is found, passes the request to the router, which strips the slash and executes the protected handler without the intended ABAC authorization decision or query filters. An unauthenticated or unauthorized network attacker can exploit this by appending a trailing slash to protected API routes, potentially enabling unauthorized read, create, update, delete, or upload operations depending on the exposed component and deployed policy. Affected versions: - BaSyx Go Components v1.0.0 and earlier We recommend updating to: v1.0.1. CVSS 9.8 · our assessment: act_now Reference: https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/580 Details: https://vuln.today/cve/CVE-2026-15704