CVE-2026-25660

Description

### Summary Authentication bypass occurs when the URL ends with Authentication with certain function calls. This bypass allows assigning arbitrary permissions to any existing user in CodeChecker. ### Details The following functions are affected under the Authentication endpoint: `getAuthorisedNames`, `getPermissionsForUser`, `hasPermission`, `addPermission`, and `removePermission`. The vulnerability allows unauthenticated users to execute these function calls with arbitrary arguments. In the logs, the exploit shows as follows: ``` [INFO 2026-04-23 21:23] - 127.0.0.1:42654 -- [Anonymous] POST /v6.67/Authentication@getAuthorisedNames [INFO 2026-04-23 21:23] - 127.0.0.1:42654 -- [Anonymous] POST /v6.67/Authentication@addPermission ``` ### Impact An attacker with a CodeChecker user can effectively acquire superuser permissions by calling these endpoints. ### Patch A patch is available at https://github.com/Ericsson/codechecker/releases/tag/v6.27.4.

How to fix CVE-2026-25660

No fixed version has been published yet. Mitigate by removing the affected package or applying upstream guidance from the references below.

• —no fix listed

Is CVE-2026-25660 being exploited?

Low — EPSS is 0.0%, meaning exploitation activity has not been observed at scale.

Affected packages (1)

• from 0, <= 6.27.3

CVSS scores

References (3)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2026-25660
• PATCHgithub.com/Ericsson/codechecker
• WEBgithub.com/Ericsson/codechecker/security/advisories/GHSA-4v9x-cqc5-j645