Ericsson CodeChecker CVE-2026-58108

Exploitation requires a valid authenticated session on the CodeChecker instance. The vendor CVSS 4.0 vector specifies PR:H (high privileges), but the vulnerability description characterizes the attacker as 'a user' without requiring administrator rights - the exact privilege level needed should be confirmed from the vendor advisory before treating PR:H as authoritative. The vulnerable code path is the personal access token deletion feature, which must be accessible to the attacker's account role. No non-default configuration, special protocol, or external network position is required beyond possessing working credentials. Unauthenticated external attackers cannot exploit this without first obtaining valid login credentials, and exploitation is limited to instances where the token management functionality is reachable.

The vendor-assigned CVSS 4.0 base score of 1.2 is very low, driven by the AC:H and PR:H metrics alongside limited individual impact (VI:L/VA:L). There is a meaningful tension between the PR:H designation in the vendor vector and the vulnerability description, which characterizes the attacker as 'a user' without specifying administrator-level rights - this discrepancy should be verified directly against the GHSA-mwpp-2jmv-26vv advisory before using the vendor score to drive prioritization decisions. Real-world impact scales with how central PATs are to the deployment: in a CodeChecker instance where PATs authenticate all CI/CD pipeline integrations, mass token deletion would halt automated analysis runs until tokens are regenerated, creating tangible workflow disruption disproportionate to the raw score. The CVSS 4.0 supplemental E:P metric confirms a proof-of-concept exists, elevating exploitation likelihood above theoretical baseline. The low CVSS score is grounded in the constrained impact domain and high privilege bar, not an absence of real effect - defenders running CodeChecker as core pipeline infrastructure should not treat 1.2 as dismissible.

An authenticated CodeChecker user with access to the token management interface - such as a developer account - sends a personal access token deletion request via the API or web UI. Because the underlying SQLAlchemy query lacks a JOIN between PersonalAccessTokenDB and Session, the DELETE executes as a cross join and removes every PAT in the system. A proof-of-concept is confirmed to exist (CVSS 4.0 E:P), meaning the exploitation path is already understood and reproducible by a motivated attacker with valid credentials.