GHSA-4V9X-CQC5-J645严重已审查

Codechecker has an authentication bypass for certain API calls

OSV 1.4.0 · github-reviewed · 修改于 2026-05-06 01:58

发布时间

2026-05-06 01:58

GitHub 审查时间

2026-05-06 01:58

NVD 发布时间

2026-04-24 22:16

源文件

advisories/github-reviewed/2026/05/GHSA-4v9x-cqc5-j645/GHSA-4v9x-cqc5-j645.json

公告说明

Summary

Authentication bypass occurs when the URL ends with Authentication with certain function calls. This bypass allows assigning arbitrary permissions to any existing user in CodeChecker.

Details

The following functions are affected under the Authentication endpoint: getAuthorisedNames, getPermissionsForUser, hasPermission, addPermission, and removePermission.

The vulnerability allows unauthenticated users to execute these function calls with arbitrary arguments. In the logs, the exploit shows as follows:

[INFO 2026-04-23 21:23] - 127.0.0.1:42654 -- [Anonymous] POST /v6.67/Authentication@getAuthorisedNames
[INFO 2026-04-23 21:23] - 127.0.0.1:42654 -- [Anonymous] POST /v6.67/Authentication@addPermission

Impact

An attacker with a CodeChecker user can effectively acquire superuser permissions by calling these endpoints.

Patch

A patch is available at https://github.com/Ericsson/codechecker/releases/tag/v6.27.4.

受影响的软件包

PyPI

标识信息

别名 / CVE

CVE-2026-25660

CWE

CWE-290CWE-863

软件生态

PyPI

扩展资料

暂无扩展资料。

CVSS 评分

CVSS_V4

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P

原始 OSV JSON

{
  "id": "GHSA-4v9x-cqc5-j645",
  "aliases": [
    "CVE-2026-25660"
  ],
  "details": "### Summary\nAuthentication bypass occurs when the URL ends with Authentication with certain function calls. This bypass allows assigning arbitrary permissions to any existing user in CodeChecker.\n\n### Details\n\nThe following functions are affected under the Authentication endpoint: `getAuthorisedNames`, `getPermissionsForUser`, `hasPermission`, `addPermission`, and `removePermission`.\n\nThe vulnerability allows unauthenticated users to execute these function calls with arbitrary arguments.\nIn the logs, the exploit shows as follows:\n```\n[INFO 2026-04-23 21:23] - 127.0.0.1:42654 -- [Anonymous] POST /v6.67/Authentication@getAuthorisedNames\n[INFO 2026-04-23 21:23] - 127.0.0.1:42654 -- [Anonymous] POST /v6.67/Authentication@addPermission\n```\n\n### Impact\nAn attacker with a CodeChecker user can effectively acquire superuser permissions by calling these endpoints.\n\n### Patch\nA patch is available at https://github.com/Ericsson/codechecker/releases/tag/v6.27.4.",
  "summary": "Codechecker has an authentication bypass for certain API calls",
  "affected": [
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "6.27.3"
            }
          ]
        }
      ],
      "package": {
        "name": "codechecker",
        "ecosystem": "PyPI"
      }
    }
  ],
  "modified": "2026-05-05T17:58:09Z",
  "severity": [
    {
      "type": "CVSS_V4",
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P"
    }
  ],
  "published": "2026-05-05T17:58:09Z",
  "references": [
    {
      "url": "https://github.com/Ericsson/codechecker/security/advisories/GHSA-4v9x-cqc5-j645",
      "type": "WEB"
    },
    {
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25660",
      "type": "ADVISORY"
    },
    {
      "url": "https://github.com/Ericsson/codechecker",
      "type": "PACKAGE"
    }
  ],
  "schema_version": "1.4.0",
  "database_specific": {
    "cwe_ids": [
      "CWE-290",
      "CWE-863"
    ],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "nvd_published_at": "2026-04-24T14:16:18Z",
    "github_reviewed_at": "2026-05-05T17:58:09Z"
  }
}