CVE-2026-25660

The vulnerability (CWE-290, CWE-863) consists of improper identity verification and authorization in certain function calls when the URL ends with a string related to the authentication process. The application incorrectly treats such a request as authorized, bypassing proper access control. As a result, an attacker without any credentials can issue administrative requests concerning user permissions.

An attacker can grant any existing user in the CodeChecker system unlimited or administrative privileges, which in practice leads to complete takeover of control over the tool instance and the code defect data stored in it.

Apply patches available from the vendor in accordance with references (GitHub Security Advisory GHSA-4v9x-cqc5-j645). Until updates are applied, it is recommended to restrict network access to the CodeChecker instance exclusively to trusted hosts and internal networks (firewall, VPN).

Ericsson CodeChecker in all versions up to and including 6.27.3.