{"id":"CVE-2026-120426","kind":"vulnerability","aliases":["CVE-2026-120426"],"related":[],"title":"OpenCSG CSGHub: unauthenticated request reads private repository files","description":"OpenCSG CSGHub through v2.6.0-ce contains an authorization bypass vulnerability in the unauthenticated file resolve route that allows remote attackers to read private repository files. Attackers can inject a percent-encoded current_user parameter into the file path, which the portal forwards with its server API key, to read files in private model, code or space repositories.","summary":"OpenCSG CSGHub through v2.6.0-ce has an unauthenticated file resolve route (/:repo_type/:namespace/:name/resolve/:branch/*path). With no user_token cookie the portal fetches files using its server API key, and a percent-encoded '?current_user=<owner>&' in the file path overrides the acting user, so private model, code and space files can be read. Dataset repos are not affected per the reporter.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"csghub","fixed":[],"affected":"<= v2.6.0-ce","ecosystem":"vendor"}],"ecosystems":[],"tags":["ai-model-hosting","csghub","other","self-hosted"],"not_affected_if":["dataset-repositories-only","no-external-exposure","version-later-than-2.6.0-ce"],"how_to_check":"- Check your CSGHub portal version: v2.6.0-ce or earlier is affected per VulnCheck.\n- Check whether the portal is reachable from untrusted networks and whether you host private model, code or space repositories.\n- Fixed version: not found in the sources read; check the OpenCSGs/csghub releases and issue #1586.","fix":null,"status":"open","published_at":"2026-11-02T15:17:23+00:00","first_seen_at":"2026-11-02T15:24:01+00:00","triaged_at":"2026-11-02T15:25:49+00:00","updated_at":"2026-11-02T15:29:36+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-02T15:25:49Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"OpenCSG CSGHub: unauthenticated request reads private repository files","impact":"high","summary":"OpenCSG CSGHub through v2.6.0-ce has an authorization bypass in its unauthenticated file resolve route. A remote attacker can read files from private model, code or space repositories by injecting a percent-encoded current_user parameter into the file path.","audience":"businesses","category":"other","nicknames":[],"who_cares":["csghub","self-hosted","ai-model-hosting"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker reads private model, code and space repository files remotely.","analyst_note":"Find the fixed release from the linked release notes on github.com and confirm the exact route and deployment conditions from the NVD and vulncheck pages.","how_to_check":"- Check whether the CSGHub version in use is `v2.6.0-ce` or earlier\n- Confirm whether the file resolve route is reachable from outside your network\n- unknown for other exact checks, the sources do not say","plain_action":"","needs_analyst":true,"not_affected_if":["version-later-than-2.6.0-ce","no-external-exposure"],"who_is_affected":"Teams that self-host CSGHub through v2.6.0-ce and expose its portal or file resolve route to a network. The portal forwards requests with its server API key, so private repositories are readable without credentials. Installations on a later release, or not reachable from untrusted networks, are not described as affected by the sources.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000704,"input_tokens":4185,"output_tokens":571,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the fixed release from the linked release notes on github.com and confirm the exact route and deployment conditions from the NVD and vulncheck pages.","search":"'-120426':11A,14A '-2026':10A,13A 'act':68B 'affect':84B 'ai':17B 'ai-model-host':16B 'allow':104C 'api':53B,133C 'attack':106C,112C 'author':94C 'branch':39B 'bypass':95C 'code':73B,141C 'contain':92C 'cooki':45B 'csghub':2A,15A,20B,26B,89C 'current':60B,119C 'cve':9A,12A 'dataset':80B 'encod':59B,118C 'fetch':48B 'file':8A,32B,49B,64B,76B,100C,111C,124C,137C 'forward':129C 'host':19B,24B 'inject':114C 'key':54B,134C 'model':18B,72B,140C 'name/resolve':38B 'namespac':37B 'opencsg':1A,25B,88C 'overrid':66B 'paramet':121C 'path':40B,65B,125C 'per':85B 'percent':58B,117C 'percent-encod':57B,116C 'portal':47B,128C 'privat':6A,71B,109C,139C 'read':5A,79B,108C,136C 'remot':105C 'repo':35B,81B 'report':87B 'repositori':7A,110C,144C 'request':4A 'resolv':33B,101C 'rout':34B,102C 'self':23B 'self-host':22B 'server':52B,132C 'space':75B,143C 'token':44B 'type':36B 'unauthent':3A,31B,99C 'use':50B 'user':43B,61B,69B,120C 'v2.6.0-ce':28B,91C 'vulner':96C","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host CSGHub through v2.6.0-ce and expose its portal or file resolve route to a network. The portal forwards requests with its server API key, so private repositories are readable without credentials. Installations on a later release, or not reachable from untrusted networks, are not described as affected by the sources.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["csghub"],"ptokens":["csghub"],"labels":["aimodelhosting","csghub","high","other","selfhosted"],"first_public_at":"2026-11-02T15:17:23+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120426","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120426","severity":null,"published_at":"2026-11-02T15:17:23+00:00","modified_at":"2026-11-02T15:17:23+00:00","first_seen_at":"2026-11-02T15:24:01+00:00","fetched_at":"2026-11-02T15:24:01+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-120426:1383","url":null,"severity":null,"published_at":"2026-11-02T15:29:36+00:00","modified_at":"2026-11-02T15:29:36+00:00","first_seen_at":"2026-11-02T15:29:36+00:00","fetched_at":"2026-11-02T15:29:36+00:00","note":"Read VulnCheck advisory and reporter write-up (hackmd). No fixed release found: the linked v2.6.0-ce release page is the affected version and returned no content; issue #1586 unreadable. Nothing marked verified (no vendor text read). Reporter's analysis is source-derived and not executed against a live system."}],"documents":[{"id":52441,"url":"https://github.com/OpenCSGs/csghub/releases/tag/v2.6.0-ce","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":52442,"url":"https://www.vulncheck.com/advisories/opencsg-csghub-through-2.6.0-ce-unauthenticated-private-repository-file-read-via-resolve-route","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"},{"id":52616,"url":"https://hackmd.io/@hieund/csghub-private-repo-file-read-idor","title":"CSGHub portal: unauthenticated private repository file disclosure via current_user injection (reporter write-up)","kind":"blog","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}