CVE-2026-25660

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-25660", "assignerOrgId": "85b1779b-6ecd-4f52-bcc5-73eac4659dcf", "state": "PUBLISHED", "assignerShortName": "ERIC", "dateReserved": "2026-02-04T12:41:54.869Z", "datePublished": "2026-04-24T13:10:26.171Z", "dateUpdated": "2026-04-24T13:51:11.174Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "85b1779b-6ecd-4f52-bcc5-73eac4659dcf", "shortName": "ERIC", "dateUpdated": "2026-04-24T13:10:26.171Z"}, "title": "Authentication bypass for certain API calls", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-290", "description": "CWE-290 Authentication bypass by spoofing", "type": "CWE"}]}, {"descriptions": [{"lang": "en", "cweId": "CWE-863", "description": "CWE-863 Incorrect Authorization", "type": "CWE"}]}], "affected": [{"vendor": "Ericsson", "product": "CodeChecker", "versions": [{"status": "affected", "version": "0", "lessThanOrEqual": "6.27.3", "changes": [{"at": "6.27.4", "status": "unaffected"}], "versionType": "python"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. \nAuthentication bypass occurs when the URL ends with Authentication with certain function calls.\u00a0 This bypass allows assigning arbitrary permission to any user existing in CodeChecker.\n\nThis issue affects CodeChecker: through 6.27.3.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<span>CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. </span><br><p>Authentication bypass occurs when the URL ends with Authentication with certain function calls.&nbsp; This bypass allows assigning arbitrary permission to any user existing in CodeChecker.</p><p>This issue affects CodeChecker: through 6.27.3.</p><p></p>"}]}], "tags": ["x_open-source"], "references": [{"url": "https://github.com/Ericsson/codechecker/security/advisories/GHSA-4v9x-cqc5-j645", "tags": ["vendor-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "exploitMaturity": "PROOF_OF_CONCEPT", "Safety": "NEGLIGIBLE", "Automatable": "YES", "Recovery": "USER", "valueDensity": "CONCENTRATED", "vulnerabilityResponseEffort": "MODERATE", "providerUrgency": "RED", "version": "4.0", "baseSeverity": "CRITICAL", "baseScore": 9.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/S:N/AU:Y/R:U/V:C/RE:M/U:Red"}}], "credits": [{"lang": "en", "value": "Scott Tolley", "type": "finder"}], "source": {"discovery": "INTERNAL"}, "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-24T13:50:59.651031Z", "id": "CVE-2026-25660", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-24T13:51:11.174Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-25660", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-24T13:50:59.651031Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-24T13:51:03.368Z"}}], "cna": {"tags": ["x_open-source"], "title": "Authentication bypass for certain API calls", "source": {"discovery": "INTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Scott Tolley"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NEGLIGIBLE", "version": "4.0", "Recovery": "USER", "baseScore": 9.3, "Automatable": "YES", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "CONCENTRATED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/S:N/AU:Y/R:U/V:C/RE:M/U:Red", "exploitMaturity": "PROOF_OF_CONCEPT", "providerUrgency": "RED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "MODERATE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Ericsson", "product": "CodeChecker", "versions": [{"status": "affected", "changes": [{"at": "6.27.4", "status": "unaffected"}], "version": "0", "versionType": "python", "lessThanOrEqual": "6.27.3"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/Ericsson/codechecker/security/advisories/GHSA-4v9x-cqc5-j645", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. \nAuthentication bypass occurs when the URL ends with Authentication with certain function calls.\u00a0 This bypass allows assigning arbitrary permission to any user existing in CodeChecker.\n\nThis issue affects CodeChecker: through 6.27.3.", "supportingMedia": [{"type": "text/html", "value": "<span>CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. </span><br><p>Authentication bypass occurs when the URL ends with Authentication with certain function calls.&nbsp; This bypass allows assigning arbitrary permission to any user existing in CodeChecker.</p><p>This issue affects CodeChecker: through 6.27.3.</p><p></p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-290", "description": "CWE-290 Authentication bypass by spoofing"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863 Incorrect Authorization"}]}], "providerMetadata": {"orgId": "85b1779b-6ecd-4f52-bcc5-73eac4659dcf", "shortName": "ERIC", "dateUpdated": "2026-04-24T13:10:26.171Z"}}}, "cveMetadata": {"cveId": "CVE-2026-25660", "state": "PUBLISHED", "dateUpdated": "2026-04-24T13:51:11.174Z", "dateReserved": "2026-02-04T12:41:54.869Z", "assignerOrgId": "85b1779b-6ecd-4f52-bcc5-73eac4659dcf", "datePublished": "2026-04-24T13:10:26.171Z", "assignerShortName": "ERIC"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "CodeChecker", "vendor": "Ericsson", "versions": [{"changes": [{"at": "6.27.4", "status": "unaffected"}], "lessThanOrEqual": "6.27.3", "status": "affected", "version": "0", "versionType": "python"}]}], "source": "85b1779b-6ecd-4f52-bcc5-73eac4659dcf"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ericsson:codechecker:*:*:*:*:*:*:*:*", "matchCriteriaId": "8ADCD29D-92CF-4F8D-AF53-64FF833A0A3F", "versionEndExcluding": "6.27.4", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. \nAuthentication bypass occurs when the URL ends with Authentication with certain function calls.\u00a0 This bypass allows assigning arbitrary permission to any user existing in CodeChecker.\n\nThis issue affects CodeChecker: through 6.27.3."}, {"lang": "es", "value": "CodeChecker es un conjunto de herramientas de an\u00e1lisis, una base de datos de defectos y una extensi\u00f3n de visualizaci\u00f3n para Clang Static Analyzer y Clang Tidy. La omisi\u00f3n de autenticaci\u00f3n ocurre cuando la URL termina con Autenticaci\u00f3n con ciertas llamadas a funciones. Esta omisi\u00f3n permite asignar permisos arbitrarios a cualquier usuario existente en CodeChecker.\n\nEste problema afecta a CodeChecker: hasta la 6.27.3."}], "id": "CVE-2026-25660", "lastModified": "2026-10-26T22:10:00.163", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "YES", "Recovery": "USER", "Safety": "NEGLIGIBLE", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "RED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "CONCENTRATED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:C/RE:M/U:Red", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "MODERATE"}, "source": "85b1779b-6ecd-4f52-bcc5-73eac4659dcf", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-25660", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-04-24T13:50:59.651031Z", "version": "2.0.3"}}]}, "published": "2026-04-24T14:16:18.127", "references": [{"source": "85b1779b-6ecd-4f52-bcc5-73eac4659dcf", "tags": ["Vendor Advisory"], "url": "https://github.com/Ericsson/codechecker/security/advisories/GHSA-4v9x-cqc5-j645"}], "sourceIdentifier": "85b1779b-6ecd-4f52-bcc5-73eac4659dcf", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-290"}, {"lang": "en", "value": "CWE-863"}], "source": "85b1779b-6ecd-4f52-bcc5-73eac4659dcf", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,6.27.3]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.27.4,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "CodeChecker", "source": "cna", "vendor": "Ericsson"}, "product": "codechecker", "vendor": "ericsson"}], "analysis": {"en": {"generated_at": "2026-04-28T06:51:25.803206+00:00", "value": {"mitigation_remediation": ["Apply the latest available CodeChecker release that addresses the authentication bypass, which covers all versions through 6.27.3.", "Review and revoke any permissions that may have been incorrectly granted to users, resetting accounts to the least privilege required for their role.", "Restrict direct API access to the Authentication endpoints or implement additional access controls (e.g., IP whitelisting or multi\u2011factor authentication) until the patch is applied to mitigate the ability to exploit the bypass."], "summary": {"action": "Immediate Patch", "impact": "Privilege Escalation"}, "threat_synthesis": {"affected_systems": "The affected vendor is Ericsson and the product is CodeChecker. All installations up to version 6.27.3 are vulnerable. Assets running this version or earlier are at risk if the authentication bypass remains unpatched.", "description_and_impact": "Authentication bypass occurs when a specific API endpoint URL ends with \"Authentication\" and allows an attacker to assign arbitrary permissions to any user in CodeChecker. This flaw represents improper authentication (CWE\u2011290) and the incorrect assignment of capabilities to the wrong principal (CWE\u2011863). The impact is a full privilege escalation within the CodeChecker environment, giving the attacker administrative or elevated rights over the defect database and potentially exposing internal defects or configuration data.", "risk_and_exploitability": "The CVSS score of 9.3 classifies this as a critical vulnerability. The EPSS score of <1% indicates that as of the last assessment the probability of exploitation is low, and the vulnerability is not currently listed in the CISA KEV catalog. Nevertheless, the likely attack vector is remote access to the exposed HTTP API endpoints, which an attacker can leverage from any network location that has API connectivity. The attack does not require elevated privileges beyond a regular user, enabling widespread use if the system is exposed."}}}}, "created": "2026-04-27T19:15:11.630633+00:00", "updated": "2026-04-28T07:00:09.510848+00:00", "vendors": ["ericsson", "ericsson$PRODUCT$codechecker"]}