---
id: "CVE-2026-25660"
kind: "vulnerability"
aliases: ["CVE-2026-25660", "GHSA-4v9x-cqc5-j645"]
title: "Codechecker has an authentication bypass for certain API calls"
severity: "critical"
cvss: 9.8
epss: 0.00447
exploited: false
status: "open"
category: "package"
products: [{"name": "codechecker", "fixed": [], "affected": "<= 6.27.3", "ecosystem": "pypi"}, {"name": "ericsson codechecker", "fixed": ["6.27.4"], "affected": "< 6.27.4", "ecosystem": "vendor"}]
ecosystems: ["pypi", "vendor"]
tags: ["codechecker", "cwe-290", "cwe-863", "package", "python", "self-hosted"]
not_affected_if: ["cli-only-use", "server-not-exposed"]
published_at: "2026-04-24T14:16:18+00:00"
first_seen_at: "2026-10-27T16:30:45+00:00"
updated_at: "2026-10-27T16:33:07+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-4v9x-cqc5-j645", "first_seen_at": "2026-10-27T16:30:45+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25660", "first_seen_at": "2026-10-27T16:33:07+00:00"}]
---

# Codechecker has an authentication bypass for certain API calls

CodeChecker's Authentication endpoint accepts certain calls (getAuthorisedNames, getPermissionsForUser, hasPermission, addPermission, removePermission) without checking the caller is logged in. An unauthenticated attacker can add or remove permissions for any existing user, including gaining superuser rights.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pypi:codechecker affected <= 6.27.3 fixed ?
- vendor:ericsson codechecker affected < 6.27.4 fixed 6.27.4

## How to check

- Run `pip show codechecker` and confirm the installed version is `6.27.3` or lower.
- Check server logs for `[Anonymous] POST /v6.67/Authentication@addPermission` or other `Authentication@` calls from `[Anonymous]` callers.

## Fix

- Upgrade the `codechecker` PyPI package to `6.27.4` or later (patch at https://github.com/Ericsson/codechecker/releases/tag/v6.27.4).
- Review the permissions table for unexpected superuser or admin grants made before the upgrade.

## Timeline

- 2026-10-27T16:30:45+00:00 ghsa https://github.com/advisories/GHSA-4v9x-cqc5-j645
- 2026-10-27T16:33:07+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-25660

## From the sources

### Summary
Authentication bypass occurs when the URL ends with Authentication with certain function calls. This bypass allows assigning arbitrary permissions to any existing user in CodeChecker.

### Details

The following functions are affected under the Authentication endpoint: `getAuthorisedNames`, `getPermissionsForUser`, `hasPermission`, `addPermission`, and `removePermission`.

The vulnerability allows unauthenticated users to execute these function calls with arbitrary arguments.
In the logs, the exploit shows as follows:
```
[INFO 2026-04-23 21:23] - 127.0.0.1:42654 -- [Anonymous] POST /v6.67/Authentication@getAuthorisedNames
[INFO 2026-04-23 21:23] - 127.0.0.1:42654 -- [Anonymous] POST /v6.67/Authentication@addPermission
```

### Impact
An attacker with a CodeChecker user can effectively acquire superuser permissions by calling these endpoints.

### Patch
A patch is available at https://github.com/Ericsson/codechecker/releases/tag/v6.27.4.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_