Eclipse BaSyx CVE-2026-15704

Requires the service to be deployed with ABAC authorization enabled (the shared router + ABAC middleware configuration) and network-reachable; that ABAC-enabled mode is the specific configuration the flaw depends on. Given ABAC is enabled, no authentication, no special privileges, and no user interaction are needed - the attacker simply appends a trailing slash to any protected route (e.g. /shells/, /submodels/, /shell-descriptors/, /lookup/shells/, /upload/). Limiting factors: deployments without ABAC enabled are not in scope for this authorization bypass, and the concrete impact (read-only vs. write/delete/upload) is bounded by which component is exposed, the HTTP method used, and the specific ABAC policy that would otherwise apply.

The signals point to a genuinely serious but conditionally-scoped issue. CVSS 3.1 base is 9.8 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) and SSVC marks Automatable:yes with Technical Impact:total, which is consistent with a trivially scriptable, unauthenticated bypass - an attacker only needs to append a slash. Against that, EPSS is low at 0.35% (28th percentile), SSVC exploitation is only 'poc' (an upstream fix/test PR, not weaponized exploit code circulating), and there is no CISA KEV listing, so this reads as high-impact-but-not-yet-widely-exploited rather than an emergency in the wild. A key qualifier the raw 9.8 obscures: exploitation only matters on ABAC-enabled deployments, and the concrete impact (read vs. create/update/delete/upload) depends on which component is exposed, the HTTP method, and the specific policy that was supposed to apply - so real-world severity varies per deployment. Because the bypass is unauthenticated and automatable and defeats the very control operators deployed for security, any organization running ABAC-enabled BaSyx services on a reachable network should treat patching as urgent even though broad opportunistic exploitation has not been observed.

An attacker who can reach a network-exposed ABAC-enabled BaSyx Submodel Repository sends GET /submodels/ (with the trailing slash) instead of GET /submodels; the ABAC middleware finds no policy match for the slashed path and lets the request through, and the router strips the slash and returns the full submodel collection that policy should have filtered or denied. With AV:N/AC:L/PR:N/UI:N the same one-character trick can be scripted across POST/PUT/DELETE/upload routes to create, modify, delete, or upload AAS data without authorization; this corresponds to the SSVC 'poc' status rather than confirmed in-the-wild use.