Live › vulnerability › CVE-2026-25660
Go to dashboardCodeChecker's Authentication endpoint accepts certain calls (getAuthorisedNames, getPermissionsForUser, hasPermission, addPermission, removePermission) without checking the caller is logged in. An unauthenticated attacker can add or remove permissions for any existing user, including gaining superuser rights.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 16:30 UTC, 0h before NVD. All times on this page are UTC.
Teams running a self-hosted CodeChecker server at version 6.27.3 or lower are exposed, since the flaw is in the server's Authentication API endpoint. Any reachable CodeChecker server where the Authentication endpoint accepts anonymous requests is in scope. Installations that only use CodeChecker locally as a CLI without running the server are not affected by this endpoint.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| codechecker | pypi | <= 6.27.3 | – |
| ericsson codechecker | vendor | < 6.27.4 | 6.27.4 |
pip show codechecker and confirm the installed version is 6.27.3 or lower.[Anonymous] POST /v6.67/Authentication@addPermission or other Authentication@ calls from [Anonymous] callers.codechecker PyPI package to 6.27.4 or later (patch at https://github.com/Ericsson/codechecker/releases/tag/v6.27.4).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Authentication bypass occurs when the URL ends with Authentication with certain function calls. This bypass allows assigning arbitrary permissions to any existing user in CodeChecker.
The following functions are affected under the Authentication endpoint: getAuthorisedNames, getPermissionsForUser, hasPermission, addPermission, and removePermission.
The vulnerability allows unauthenticated users to execute these function calls with arbitrary arguments. In the logs, the exploit shows as follows:
[INFO 2026-04-23 21:23] - 127.0.0.1:42654 -- [Anonymous] POST /v6.67/Authentication@getAuthorisedNames
[INFO 2026-04-23 21:23] - 127.0.0.1:42654 -- [Anonymous] POST /v6.67/Authentication@addPermission
An attacker with a CodeChecker user can effectively acquire superuser permissions by calling these endpoints.
A patch is available at https://github.com/Ericsson/codechecker/releases/tag/v6.27.4.
This page as .md · .json · in your agent: get_signal("CVE-2026-25660")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.