CVE-2026-123485 | BDVDB-2026-401249 Detail

Description#

Ground Station from 0.6.0 before 0.8.20 does not restrict the get-orbital-sources Socket.IO handler (also exposed as get-tle-sources) to administrators, although the orbital-source write handlers are admin-only. An authenticated operator-role user can call either handler to retrieve the plaintext usernames, passwords, and tokens that administrators stored for basic and token orbital sources.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-11-06Record published in the CVE List.