{"id":"CVE-2026-25660","aliases":["GHSA-4v9x-cqc5-j645","PYSEC-2026-317"],"title":"Codechecker has an authentication bypass for certain API calls","summary":"Codechecker has an authentication bypass for certain API calls","severity":"critical","vendor":"codechecker","product":"codechecker","ecosystem":"pip","affected":["codechecker <= 6.27.3"],"published":"2026-05-05","updated":"2026-10-27","sourceUpdated":"2026-10-27T16:45:03.525213578Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-4v9x-cqc5-j645","references":[{"url":"https://github.com/Ericsson/codechecker/security/advisories/GHSA-4v9x-cqc5-j645"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25660"},{"url":"https://github.com/Ericsson/codechecker"},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/codechecker/PYSEC-2026-317.yaml"},{"url":"https://pypi.org/project/codechecker"},{"url":"https://github.com/advisories/GHSA-4v9x-cqc5-j645"}],"tags":["osv","pip","ghsa"],"epss":0.00447,"epssPercentile":0.3869,"cwe":["CWE-290","CWE-863"],"ingestedAt":"2026-10-27T16:32:34.344Z","slug":"CVE-2026-25660","body":"## Overview\n\n### Summary\nAuthentication bypass occurs when the URL ends with Authentication with certain function calls. This bypass allows assigning arbitrary permissions to any existing user in CodeChecker.\n\n### Details\n\nThe following functions are affected under the Authentication endpoint: `getAuthorisedNames`, `getPermissionsForUser`, `hasPermission`, `addPermission`, and `removePermission`.\n\nThe vulnerability allows unauthenticated users to execute these function calls with arbitrary arguments.\nIn the logs, the exploit shows as follows:\n```\n[INFO 2026-04-23 21:23] - 127.0.0.1:42654 -- [Anonymous] POST /v6.67/Authentication@getAuthorisedNames\n[INFO 2026-04-23 21:23] - 127.0.0.1:42654 -- [Anonymous] POST /v6.67/Authentication@addPermission\n```\n\n### Impact\nAn attacker with a CodeChecker user can effectively acquire superuser permissions by calling these endpoints.\n\n### Patch\nA patch is available at https://github.com/Ericsson/codechecker/releases/tag/v6.27.4.\n\n## Affected packages\n\n- `codechecker <= 6.27.3`\n\n## Remediation\n\nRefer to the advisory for the patched release.","depth":"midnight","depthScore":52,"depthScoreParts":{"impact":52.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}