---
id: CVE-2026-120426
title: >-
  OpenCSG CSGHub through v2.6.0-ce Unauthenticated Private Repository File Read
  via Resolve Route
summary: >-
  OpenCSG CSGHub through v2.6.0-ce contains an authorization bypass
  vulnerability in the unauthenticated file resolve route that allows remote
  attackers to read private repository files. Attackers can inject a
  percent-encoded current_user …
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-639
vendor: OpenCSG
product: CSGHub
affected:
  - CSGHub <= v2.6.0-ce
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-11-05T21:34:16.823553Z'
published: '2026-11-02'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T21:34:30.350Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-120426'
references:
  - url: 'https://github.com/OpenCSGs/csghub/issues/1586'
  - url: >-
      https://github.com/OpenCSGs/csghub/blob/v2.6.0-ce/internal/routes/router.go#L302-L303
  - url: >-
      https://github.com/OpenCSGs/csghub/blob/v2.6.0-ce/internal/handlers/frontend/resolve.go#L138-L151
  - url: >-
      https://github.com/OpenCSGs/csghub/blob/v2.6.0-ce/pkg/server/backend/csghubserver/download.go#L10-L41
  - url: >-
      https://github.com/OpenCSGs/csghub-server/blob/v2.6.0-ce/api/middleware/authenticator.go#L210-L226
  - url: 'https://github.com/OpenCSGs/csghub/releases/tag/v2.6.0-ce'
    label: CSGHub v2.6.0-ce Release Notes
  - url: 'https://hackmd.io/@hieund/csghub-private-repo-file-read-idor'
  - url: >-
      https://www.vulncheck.com/advisories/opencsg-csghub-through-2.6.0-ce-unauthenticated-private-repository-file-read-via-resolve-route
    label: >-
      VulnCheck Advisory: OpenCSG CSGHub through v2.6.0-ce Unauthenticated
      Private Repository File Read via Resolve Route
tags:
  - cve.org
epss: 0.00403
epssPercentile: 0.34749
ingestedAt: '2026-11-05T19:30:42.652Z'
---

## Overview

OpenCSG CSGHub through v2.6.0-ce contains an authorization bypass vulnerability in the unauthenticated file resolve route that allows remote attackers to read private repository files. Attackers can inject a percent-encoded current_user parameter into the file path, which the portal forwards with its server API key, to read files in private model, code or space repositories.

## Affected

- `CSGHub <= v2.6.0-ce`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.