In Eclipse BaSyx Go Components versions up to and including 1.1.2, ABAC-enabled deployments of...

In Eclipse BaSyx Go Components versions up to and including 1.1.2, ABAC-enabled deployments of the Submodel Repository and the AAS Environment do not apply an access rule's FILTERLIST fragment filters to single Submodel reads.

GET /submodels removes the fields that a rule's FILTERLIST hides, but GET /submodels/{submodelIdentifier} and GET /submodels/{submodelIdentifier}/$metadata return them unfiltered. An authenticated caller with READ access to a Submodel can therefore read fields that the access rules hide from them, for example supplementalSemanticIds keys that name the other parties allowed to read the Submodel.

If versioning is enabled (history.mode set to api or audit), GET /submodels/{submodelIdentifier}/$history and GET /shells/{aasIdentifier}/$history in the Submodel Repository, AAS Repository and AAS Environment return the complete stored version without applying the rule's formula or fragment filters. A caller whose rules grant READ on these routes can read fields that the access rules hide, and Submodels and Asset Administration Shells that the direct read does not return to them at all.

The issue is fixed in Eclipse BaSyx Go Components v1.1.3.