What is CVE-2026-15704?
In Eclipse BaSyx Go Components versions up to and including 1.0.0, ABAC-enabled deployments are vulnerable to an authorization bypass due to inconsistent trailing-slash handling between the ABAC middleware and the HTTP router. The shared router configuration uses Chi's `middleware.StripSlashes`, which leads to potential unauthorized access. It is recommended to ensure consistent trailing-slash processing to mitigate this bypass vulnerability.
Azərbaycanca: Eclipse BaSyx Go Components-in 1.0.0 və aşağı versiyalarında, ABAC aktiv olan mühitdə autorizasiya bypass zəifliyi aşkarlanıb. Problem ABAC middleware ilə HTTP router arasında `trailing-slash` emalındakı uyğunsuzluqdan qaynaqlanır, çünki `middleware.StripSlashes` istifadəsi yan keçidə səbəb olur. Bu zəiflikdən qorunmaq üçün trailing-slash emalını vahid qaydada tənzimləmək tövsiyə olunur.
Related CVEs
link basis: same weakness class CWE-863
FAQ2
Which versions of Eclipse BaSyx Go Components contain the authorization bypass vulnerability in ABAC environments?
The vulnerability exists in Eclipse BaSyx Go Components versions up to and including 1.0.0, when deployed with ABAC enabled.
What is the root cause of this vulnerability?
The root cause is inconsistent trailing-slash handling between the ABAC middleware and the HTTP router. The shared router configuration uses Chi's `middleware.StripSlashes`, which leads to the authorization bypass.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.