CVE-2026-25660: Authentication bypass for certain API calls

Published Apr 24, 2026
·
Updated

Summary Authentication bypass occurs when the URL ends with Authentication with certain function calls. This bypass allows assigning arbitrary permissions to any existing user in CodeChecker.

Details

The following functions are affected under the Authentication endpoint: getAuthorisedNames, getPermissionsForUser, hasPermission, addPermission, and removePermission.

The vulnerability allows unauthenticated users to execute these function calls with arbitrary arguments. In the logs, the exploit shows as follows: [INFO 2026-04-23 21:23] - 127.0.0.1:42654 -- [Anonymous] POST /v6.67/Authentication@getAuthorisedNames [INFO 2026-04-23 21:23] - 127.0.0.1:42654 -- [Anonymous] POST /v6.67/Authentication@addPermission

Impact An attacker with a CodeChecker user can effectively acquire superuser permissions by calling these endpoints.

Patch A patch is available at https://github.com/Ericsson/codechecker/releases/tag/v6.27.4.

Other sources

CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. Authentication bypass occurs when the URL ends with Authentication with certain function calls.  This bypass allows assigning arbitrary permission to any user existing in CodeChecker.

This issue affects CodeChecker: through 6.27.3.

MITRE

Affected Software

3 affected components
Ericsson CodeChecker<=6.27.3
Ericsson CodeChecker<6.27.4
pip/codechecker<=6.27.3

Event History

Apr 24, 2026
CVE Published
via MITRE·01:10 PM
Data Sourced
via MITRE·01:10 PM
DescriptionWeakness
Data Sourced
via NVD·02:16 PM
DescriptionSeverityWeaknessAffected Software
May 5, 2026
Advisory Published
via GitHub·05:58 PM
Data Sourced
via GitHub·05:58 PM
DescriptionWeaknessAffected Software
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2026-25660?

CVE-2026-25660 is considered a critical severity vulnerability due to the risk of authentication bypass.

2

How do I fix CVE-2026-25660?

To fix CVE-2026-25660, update Ericsson CodeChecker to version 6.27.4 or later.

3

What kind of vulnerability is CVE-2026-25660?

CVE-2026-25660 is an authentication bypass vulnerability affecting certain API calls.

4

Which versions of CodeChecker are affected by CVE-2026-25660?

CVE-2026-25660 affects Ericsson CodeChecker versions up to and including 6.27.3.

5

What impact does CVE-2026-25660 have?

CVE-2026-25660 allows for unauthorized access to certain functionalities within the API, potentially leading to arbitrary assignments.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203