{"id":"CVE-2026-25660","kind":"vulnerability","aliases":["CVE-2026-25660","GHSA-4v9x-cqc5-j645"],"related":[],"title":"Codechecker has an authentication bypass for certain API calls","description":"### Summary\nAuthentication bypass occurs when the URL ends with Authentication with certain function calls. This bypass allows assigning arbitrary permissions to any existing user in CodeChecker.\n\n### Details\n\nThe following functions are affected under the Authentication endpoint: `getAuthorisedNames`, `getPermissionsForUser`, `hasPermission`, `addPermission`, and `removePermission`.\n\nThe vulnerability allows unauthenticated users to execute these function calls with arbitrary arguments.\nIn the logs, the exploit shows as follows:\n```\n[INFO 2026-04-23 21:23] - 127.0.0.1:42654 -- [Anonymous] POST /v6.67/Authentication@getAuthorisedNames\n[INFO 2026-04-23 21:23] - 127.0.0.1:42654 -- [Anonymous] POST /v6.67/Authentication@addPermission\n```\n\n### Impact\nAn attacker with a CodeChecker user can effectively acquire superuser permissions by calling these endpoints.\n\n### Patch\nA patch is available at https://github.com/Ericsson/codechecker/releases/tag/v6.27.4.","summary":"CodeChecker's Authentication endpoint accepts certain calls (getAuthorisedNames, getPermissionsForUser, hasPermission, addPermission, removePermission) without checking the caller is logged in. An unauthenticated attacker can add or remove permissions for any existing user, including gaining superuser rights.","severity":"critical","cvss":9.8,"epss":0.00447,"exploited":false,"exploited_at":null,"products":[{"name":"codechecker","fixed":[],"affected":"<= 6.27.3","ecosystem":"pypi"},{"name":"ericsson codechecker","fixed":["6.27.4"],"affected":"< 6.27.4","ecosystem":"vendor"}],"ecosystems":["pypi","vendor"],"tags":["codechecker","cwe-290","cwe-863","package","python","self-hosted"],"not_affected_if":["cli-only-use","server-not-exposed"],"how_to_check":"- Run `pip show codechecker` and confirm the installed version is `6.27.3` or lower.\n- Check server logs for `[Anonymous] POST /v6.67/Authentication@addPermission` or other `Authentication@` calls from `[Anonymous]` callers.","fix":"- Upgrade the `codechecker` PyPI package to `6.27.4` or later (patch at https://github.com/Ericsson/codechecker/releases/tag/v6.27.4).\n- Review the permissions table for unexpected superuser or admin grants made before the upgrade.","status":"open","published_at":"2026-04-24T14:16:18+00:00","first_seen_at":"2026-10-27T16:30:45+00:00","triaged_at":"2026-10-27T16:31:54+00:00","updated_at":"2026-10-27T16:33:07+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-27T16:31:54Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the `codechecker` PyPI package to `6.27.4` or later (patch at https://github.com/Ericsson/codechecker/releases/tag/v6.27.4).\n- Review the permissions table for unexpected superuser or admin grants made before the upgrade.","reach":"network","title":"CodeChecker: unauthenticated API calls grant arbitrary permissions to users","impact":"high","summary":"CodeChecker's Authentication endpoint accepts certain calls (getAuthorisedNames, getPermissionsForUser, hasPermission, addPermission, removePermission) without checking the caller is logged in. An unauthenticated attacker can add or remove permissions for any existing user, including gaining superuser rights.","category":"package","nicknames":[],"who_cares":["codechecker","self-hosted","python"],"confidence":0.8,"needs_auth":"no","worst_case":"Unauthenticated attacker grants themselves superuser permissions on the server","analyst_note":"","how_to_check":"- Run `pip show codechecker` and confirm the installed version is `6.27.3` or lower.\n- Check server logs for `[Anonymous] POST /v6.67/Authentication@addPermission` or other `Authentication@` calls from `[Anonymous]` callers.","needs_analyst":false,"not_affected_if":["cli-only-use","server-not-exposed"],"who_is_affected":"Teams running a self-hosted CodeChecker server at version 6.27.3 or lower are exposed, since the flaw is in the server's Authentication API endpoint. Any reachable CodeChecker server where the Authentication endpoint accepts anonymous requests is in scope. Installations that only use CodeChecker locally as a CLI without running the server are not affected by this endpoint.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000687,"input_tokens":3635,"output_tokens":648,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-04':134C,146C '-2026':11A,19A '-23':135C,147C '-25660':12A,20A '-290':26B '-863':28B '/ericsson/codechecker/releases/tag/v6.27.4.':180C '/v6.67/authentication':142C,154C '127.0.0.1':138C,150C '2026':133C,145C '21':136C,148C '23':137C,149C '42654':139C,151C '4v9x':15A 'accept':38B 'acquir':165C 'add':57B 'addpermiss':44B,108C,155C 'affect':100C 'allow':85C,113C 'anonym':140C,152C 'api':8A 'arbitrari':87C,122C 'argument':123C 'assign':86C 'attack':55B,158C 'authent':4A,36B,70C,78C,103C 'avail':176C 'bypass':5A,71C,84C 'call':9A,40B,82C,120C,169C 'caller':49B 'certain':7A,39B,80C 'check':47B 'codecheck':1A,24B,34B,94C,161C 'codechecker':21A,23A 'cqc5':16A 'cve':10A,18A 'cwe':25B,27B 'detail':95C 'effect':164C 'end':76C 'endpoint':37B,104C,171C 'ericsson':22A 'execut':117C 'exist':63B,91C 'exploit':128C 'follow':97C,131C 'function':81C,98C,119C 'gain':66B 'getauthorisednam':41B,105C,143C 'getpermissionsforus':42B,106C 'ghsa':14A 'ghsa-4v9x-cqc5-j645':13A 'github.com':179C 'github.com/ericsson/codechecker/releases/tag/v6.27.4.':178C 'haspermiss':43B,107C 'host':33B 'impact':156C 'includ':65B 'info':132C,144C 'j645':17A 'log':51B,126C 'occur':72C 'packag':29B 'patch':172C,174C 'permiss':60B,88C,167C 'post':141C,153C 'python':30B 'remov':59B 'removepermiss':45B,110C 'right':68B 'self':32B 'self-host':31B 'show':129C 'summari':69C 'superus':67B,166C 'unauthent':54B,114C 'url':75C 'user':64B,92C,115C,162C 'vulner':112C 'without':46B","nicknames":[],"mitigations":[],"who_affected":"Teams running a self-hosted CodeChecker server at version 6.27.3 or lower are exposed, since the flaw is in the server's Authentication API endpoint. Any reachable CodeChecker server where the Authentication endpoint accepts anonymous requests is in scope. Installations that only use CodeChecker locally as a CLI without running the server are not affected by this endpoint.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-04-24T14:16:18+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:C/RE:M/U:Red","cvss_by":"85b1779b-6ecd-4f52-bcc5-73eac4659dcf","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-4v9x-cqc5-j645","url":"https://github.com/advisories/GHSA-4v9x-cqc5-j645","severity":"critical","published_at":"2026-05-05T17:58:09+00:00","modified_at":"2026-10-27T16:27:41+00:00","first_seen_at":"2026-10-27T16:30:45+00:00","fetched_at":"2026-10-27T16:30:45+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-25660","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25660","severity":null,"published_at":"2026-04-24T14:16:18+00:00","modified_at":"2026-10-26T22:10:00+00:00","first_seen_at":"2026-10-27T16:33:07+00:00","fetched_at":"2026-10-27T16:33:07+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}