EUVD-2026-66297Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:C/RE:L/U:X
Network-reachable via API; description implies any authenticated user (PR:L), not admin; no confidentiality impact; low integrity and availability from mass PAT deletion.
Primary rating from Vendor (ERIC).
CVSS VectorVendor: ERIC
Lifecycle Timeline
2DescriptionCVE.org
The personal access token removal query selects from PersonalAccessTokenDB but filters on columns of Session, with no join between them. SQLAlchemy resolves that as an implicit cross join, so the filter does not constrain the delete to the calling user's own token in the way the code reads as intending. This way a user can delete all personal access tokens in the system.
AnalysisAI
Improper access control in Ericsson CodeChecker allows an authenticated user to delete all personal access tokens system-wide due to a SQLAlchemy ORM query bug in the token removal path. The DELETE query targets PersonalAccessTokenDB but applies a filter referencing Session table columns without any JOIN, causing SQLAlchemy to construct an implicit cross join (Cartesian product) that bypasses per-user scoping entirely. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid authenticated session on the CodeChecker instance. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-assigned CVSS 4.0 base score of 1.2 is very low, driven by the AC:H and PR:H metrics alongside limited individual impact (VI:L/VA:L). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary remediation is to apply the fix described in the Ericsson CodeChecker security advisory at https://github.com/Ericsson/codechecker/security/advisories/GHSA-mwpp-2jmv-26vv; no specific patched version number is confirmed in the available data, so the advisory must be consulted directly for an exact target upgrade version. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Codechecker
View allCodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. R
Authentication bypass in CodeChecker allows remote unauthenticated attackers to assign arbitrary permissions to any user
CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. R
CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. R
Memory exhaustion and disk consumption in Ericsson CodeChecker's massStoreRun API endpoint allows authenticated users ho
Stack buffer overflow in Ericsson CodeChecker through 6.28.2 results from an off-by-two error introduced during the CVE-
CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. R
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today