CVE-2026-25660: Authentication bypass for certain API calls
Summary Authentication bypass occurs when the URL ends with Authentication with certain function calls. This bypass allows assigning arbitrary permissions to any existing user in CodeChecker.
Details
The following functions are affected under the Authentication endpoint: getAuthorisedNames, getPermissionsForUser, hasPermission, addPermission, and removePermission.
The vulnerability allows unauthenticated users to execute these function calls with arbitrary arguments. In the logs, the exploit shows as follows: [INFO 2026-04-23 21:23] - 127.0.0.1:42654 -- [Anonymous] POST /v6.67/Authentication@getAuthorisedNames [INFO 2026-04-23 21:23] - 127.0.0.1:42654 -- [Anonymous] POST /v6.67/Authentication@addPermission
Impact An attacker with a CodeChecker user can effectively acquire superuser permissions by calling these endpoints.
Patch A patch is available at https://github.com/Ericsson/codechecker/releases/tag/v6.27.4.
Other sources
CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. Authentication bypass occurs when the URL ends with Authentication with certain function calls. This bypass allows assigning arbitrary permission to any user existing in CodeChecker.
This issue affects CodeChecker: through 6.27.3.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-25660?
CVE-2026-25660 is considered a critical severity vulnerability due to the risk of authentication bypass.
How do I fix CVE-2026-25660?
To fix CVE-2026-25660, update Ericsson CodeChecker to version 6.27.4 or later.
What kind of vulnerability is CVE-2026-25660?
CVE-2026-25660 is an authentication bypass vulnerability affecting certain API calls.
Which versions of CodeChecker are affected by CVE-2026-25660?
CVE-2026-25660 affects Ericsson CodeChecker versions up to and including 6.27.3.
What impact does CVE-2026-25660 have?
CVE-2026-25660 allows for unauthorized access to certain functionalities within the API, potentially leading to arbitrary assignments.