Summary Authentication bypass occurs when the URL ends with Authentication with certain function calls. This bypass allows assigning arbitrary permissions to any existing user in CodeChecker.

Details

The following functions are affected under the Authentication endpoint: getAuthorisedNames, getPermissionsForUser, hasPermission, addPermission, and removePermission.

The vulnerability allows unauthenticated users to execute these function calls with arbitrary arguments. In the logs, the exploit shows as follows: [INFO 2026-04-23 21:23] - 127.0.0.1:42654 -- [Anonymous] POST /v6.67/Authentication@getAuthorisedNames [INFO 2026-04-23 21:23] - 127.0.0.1:42654 -- [Anonymous] POST /v6.67/Authentication@addPermission

Impact An attacker with a CodeChecker user can effectively acquire superuser permissions by calling these endpoints.

Patch A patch is available at https://github.com/Ericsson/codechecker/releases/tag/v6.27.4.

Summary CodeChecker versions up to 6.26.1 contain a buffer overflow vulnerability in the internal ldlogger library, which is executed by the CodeChecker log command.

Details Unsafe usage of strcpy() function in the internal ldlogger library allows attackers to trigger a buffer overflow by supplying crafted inputs from the command line. Specifically, the destination buffer is stack-allocated with a fixed size of 4096 bytes, while strcpy() is called without any length checks, enabling an attacker to overrun the buffer.

PoC Example script is included below to illustrate how this vulnerability can be exploited. bash #!/bin/bash

export CCLOGGERDEFDIRS=1; payload=''; for i in $(seq 1 4090); do payload+='A'; done

CodeChecker log -b "/very/long/path/to/$payload/gcc a.c" -o compilation.json

Impact Any environment where the vulnerable CodeChecker log command is executed with untrusted user input is affected by this vulnerability.

Summary Authentication bypass occurs when the API URL ends with Authentication, Configuration or ServerInfo. This bypass allows superuser access to all API endpoints other than Authentication. These endpoints include the ability to add, edit, and remove products, among others.

Details All endpoints, apart from the /Authentication is affected by the vulnerability.

The vulnerability allows unauthenticated users to access all API functionality. You can look for the following pattern in the logs to check if the vulnerabilty was exploited: !image

Note that the url starts with v and contains a valid CodeChecker endpoint, but it ends in Authentication, Configuration or ServerInfo and it was made by an Anonymous user.

Impact This authentication bypass allows querying, adding, changing, and deleting Products contained on the CodeChecker server, without authentication, by an anonymous user.

In Ericsson CodeChecker through 6.18.0, a Stored Cross-site scripting (XSS) vulnerability in the comments component of the reports viewer allows remote attackers to inject arbitrary web script or HTML via the POST JSON data of the /CodeCheckerService API.