CVE-2026-58108: Personal access token delete filters on Session columns while deleting from PersonalAccessTokenDB
The personal access token removal query selects from PersonalAccessTokenDB but filters on columns of Session, with no join between them. SQLAlchemy resolves that as an implicit cross join, so the filter does not constrain the delete to the calling user's own token in the way the code reads as intending. This way a user can delete all personal access tokens in the system.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Change the PersonalAccessTokenDB delete statement so the WHERE clause only uses columns from PersonalAccessTokenDB (or uses Session columns via an explicit join/correlated subquery). Ensure the delete is constrained to the calling user's token(s) rather than permitting an implicit cross join that can delete all tokens.
PersonalAccessTokenDB deletion query (SQLAlchemy) Delete query should constrain tokens by calling user (add proper join or use correlated subquery) = No longer filter PersonalAccessTokenDB delete using Session columns without joining; instead join/correlate to the authenticated user's token/session identity so the delete affects only the caller’s own token(s).
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The issue is exploitable by a user who can invoke personal access token removal. The flaw allows that user to delete personal access tokens belonging to other users, potentially all tokens in the system.
What is the operational impact if this is exploited?
Personal access tokens across the system can be deleted, which can invalidate token-based access for affected users and disrupt integrations or automation that rely on those tokens.